No access to your tenant or devices. Every item links to its source. What this means
Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
Read the publisher's advisoryHelm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
Read the publisher's advisoryHelm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
Read the publisher's advisoryA Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow. ### Impact A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. ### Patches This issue has been resolved in Helm v3.17.3. ### Workarounds Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB. ### For more information Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document. ### Credits Disclosed by Jakub Ciolek at AlphaSense.
Read the publisher's advisoryHelm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "helm",
"product": "helm",
"versions": [
{
"version": "< 3.17.3",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
datePublished: Apr 9, 2025, 10:28:33 PM
dateUpdated: Apr 10, 2025, 2:58:47 PM
openSUSE-SU-2025:14995-1: govulncheck-vulndb-0.0.20250410T162706-1.1 on GA media
CVE-2025-32386 · CVE-2025-32387
SUSE-SU-2025:01830-1: Security update for helm-mirror
CVE-2025-32386 · CVE-2025-32387
SUSE-SU-2025:01830-2: Security update for helm-mirror
CVE-2025-32386 · CVE-2025-32387
msrc_CVE-2025-32387: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
CVE-2025-32387
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-121 · CWE-674
published: 2025-04-09T23:15:37.903
lastModified: 2026-06-17T09:11:55.210
The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0 → fixed 3.17.3
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0 → fixed 3.17.3
Original source record · Cite this exact observation · Complete original publisher JSON