| Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segmentCVE-2026-35206 · GHSA-HR2V-4R36-88HRVersion ranges need review. |
helm.sh/helm/v3helm.sh/helm/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm dependency management path traversalCVE-2024-25620 · GHSA-V53G-5GJP-272RVersion ranges need review. |
helm.sh/helm/v3OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm's Missing YAML Content Leads To PanicCVE-2024-26147 · GHSA-R53H-JV2G-VPX6Version ranges need review. |
helm.sh/helm/v3Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/multicluster-operators-channel-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Helm vulnerable to denial of service through string value parsingCVE-2022-23524 · GHSA-6RX9-889Q-VV2RVersion ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/jenkins-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to denial of service through schema fileCVE-2022-23526 · GHSA-67FX-WX78-JX33Version ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to information disclosure via getHostByName Function CVE-2023-25165 · GHSA-PWCW-6F5G-GXF8Version ranges need review. |
helm.sh/helm/v3Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm uses crypto package vulnerable to panic from malformed X.509 certificateCVE-2020-7919 · GHSA-CJJC-XP8V-855WVersion ranges need review. |
github.com/helm/helmgolang.org/x/crypto |
Go |
High
|
Fix reported |
|
| Helm Allows A Specially Crafted JSON Schema To Cause A Stack OverflowCVE-2025-32387 · GHSA-5XQW-8HWV-WG92Version ranges need review. |
helm.sh/helm/v3Deployment Validation Operator/deployment-validation-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to denial of service through through repository index fileCVE-2022-23525 · GHSA-53C4-HHMH-VW5QVersion ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/jenkins-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to Code Injection through malicious chart.yaml contentCVE-2025-53547 · GHSA-557J-XG8C-Q2MMVersion ranges need review. |
helm.sh/helm/v3Deployment Validation Operator/dvo/deployment-validation-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationCVE-2025-32386 · GHSA-4HFP-H4CW-HJ8PVersion ranges need review. |
helm.sh/helm/v3Deployment Validation Operator/deployment-validation-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm Charts with Specific JSON Schema Values Can Cause Memory ExhaustionCVE-2025-55199 · GHSA-9H84-QMV7-982PVersion ranges need review. |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm Vulnerable to denial of service through string value parsingCVE-2022-36055 · GHSA-7HFP-QFW3-5JXHVersion ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm May Panic Due To Incorrect YAML ContentCVE-2025-55198 · GHSA-F9F8-9PMF-XV68Version ranges need review. |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| plugin.yaml file allows for duplicate entries in helmCVE-2020-15187 · GHSA-C52F-PQ47-2R9J |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Low
|
Fix reported |
|
| Improper Neutralization of Special Elements in Output in helm.sh/helm/v3CVE-2021-21303 · GHSA-C38G-469G-CMGXVersion ranges need review. |
helm.sh/helm/v3 |
Go |
Medium
|
Fix reported |
|
| Helm passes repository credentials to alternate domainCVE-2021-32690 · GHSA-56HP-XQP3-W2JF |
helm.sh/helm/v3OpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Plugin archive directory traversal in HelmCVE-2020-4053 · GHSA-QQ3J-XP49-J73F |
helm.sh/helm/v3 |
Go |
Low
|
Fix reported |
|
| Improper Sanitizing of plugin names in helmCVE-2020-15186 · GHSA-M54R-VRMV-HW33 |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Low
|
Fix reported |
|
| Repository index file allows for duplicates of the same chart entry in helmCVE-2020-15185 · GHSA-JM56-5H66-W453 |
helm.sh/helm/v3helm.sh/helm |
GoRed Hat |
Low
|
Fix reported |
|
