Skip to main content
cve.nowby Sazabi
← Go
GoPackage

helm.sh/helm

9 known vulnerabilities (2 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 medium, 4 low
Registry
pkg.go.dev

Advisories 9

  • CVE-2025-55198Medium 6.5

    Helm May Panic Due To Incorrect YAML Content

    Affected: all versions.

  • CVE-2025-55199Medium 6.5

    Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

    Affected: all versions.

  • Duplicate plugin entries in Helm

    Affected: from 2.0.0, fixed in 2.16.11.

  • Improper sanitization of plugin names in Helm

    Affected: fixed in 2.16.11.

  • Duplicated chart entries in Helm

    Affected: fixed in 2.16.11.

  • Aliases are never checked in Helm

    Affected: fixed in 2.16.11.

  • In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a…

    Affected: from 2.0.0+incompatible, fixed in 2.15.2+incompatible; from 2.0.0, fixed in 2.15.2.

  • helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation.

    Affected: fixed in 2.7.2; fixed in 2.7.2+incompatible.

  • All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory…

    Affected: from 2.0.0+incompatible, fixed in 2.12.2+incompatible; from 2.0.0, fixed in 2.12.2.