# helm.sh/helm/v3 (Go) vulnerabilities

22 known vulnerabilities (3 high, 13 medium, 5 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/helm.sh/helm/v3

## Advisories (22)

### [CVE-2026-35206](https://cve.now/CVE-2026-35206): Helm Chart extraction output directory collapse via \`Chart.yaml\` name dot-segment

- Severity: Medium 4.8
- Published: Apr 9, 2026
- Affected: fixed in 3.20.2.

### [CVE-2025-55198](https://cve.now/CVE-2025-55198): Helm May Panic Due To Incorrect YAML Content

- Severity: Medium 6.5
- Published: Aug 13, 2025
- Affected: fixed in 3.18.5.

### [CVE-2025-55199](https://cve.now/CVE-2025-55199): Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

- Severity: Medium 6.5
- Published: Aug 13, 2025
- Affected: fixed in 3.18.5.

### [CVE-2025-53547](https://cve.now/CVE-2025-53547): Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution

- Severity: High 8.5
- Published: Jul 8, 2025
- Affected: from 3.18.0-rc.1, fixed in 3.18.4; fixed in 3.17.4; fixed in 3.18.4.

### [CVE-2025-32386](https://cve.now/CVE-2025-32386): Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

- Severity: Medium 6.5
- Published: Apr 9, 2025
- Affected: fixed in 3.17.3.

### [CVE-2025-32387](https://cve.now/CVE-2025-32387): Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

- Severity: Medium 6.5
- Published: Apr 9, 2025
- Affected: fixed in 3.17.3.

### [CVE-2024-26147](https://cve.now/CVE-2024-26147): Helm's Missing YAML Content Leads To Panic

- Severity: High 7.5
- Published: Feb 21, 2024
- Affected: fixed in 3.14.2.

### [CVE-2024-25620](https://cve.now/CVE-2024-25620): Dependency management path traversal in helm

- Severity: Medium 6.4
- Published: Feb 14, 2024
- Affected: fixed in 3.14.1.

### [CVE-2023-25165](https://cve.now/CVE-2023-25165): getHostByName Function Information Disclosure

- Severity: Medium 4.3
- Published: Feb 8, 2023
- Affected: fixed in 3.11.1; from 3.0.0, fixed in 3.11.1.

### [CVE-2022-23526](https://cve.now/CVE-2022-23526): Helm contains Denial of service through schema file

- Severity: Medium 5.3
- Published: Dec 15, 2022
- Affected: fixed in 3.10.3.

### [CVE-2022-23525](https://cve.now/CVE-2022-23525): Helm vulnerable to Denial of service via NULL Pointer Dereference

- Severity: Medium 5.3
- Published: Dec 15, 2022
- Affected: fixed in 3.10.3.

### [CVE-2022-23524](https://cve.now/CVE-2022-23524): Helm vulnerable to Denial of service through string value parsing

- Severity: Medium 5.3
- Published: Dec 15, 2022
- Affected: fixed in 3.10.3.

### [CVE-2022-36055](https://cve.now/CVE-2022-36055): Denial of service in Helm

- Severity: Medium 6.5
- Published: Sep 1, 2022
- Affected: fixed in 3.9.4.

### [CVE-2021-32690](https://cve.now/CVE-2021-32690): Repository credentials passed to alternate domain

- Severity: Medium 6.8
- Published: Jun 16, 2021
- Affected: fixed in 3.6.1.

### [CVE-2021-21303](https://cve.now/CVE-2021-21303): Injection attack in Helm

- Severity: Medium 5.9
- Published: Feb 5, 2021
- Affected: from 3.0.0, fixed in 3.5.2.

### [CVE-2020-15187](https://cve.now/CVE-2020-15187): Duplicate plugin entries in Helm

- Severity: Low 3.0
- Published: Sep 17, 2020
- Affected: from 3.0.0, fixed in 3.3.2.

### [CVE-2020-15186](https://cve.now/CVE-2020-15186): Improper sanitization of plugin names in Helm

- Severity: Low 3.4
- Published: Sep 17, 2020
- Affected: from 3.0.0, fixed in 3.3.2.

### [CVE-2020-15185](https://cve.now/CVE-2020-15185): Duplicated chart entries in Helm

- Severity: Low 2.2
- Published: Sep 17, 2020
- Affected: from 3.0.0, fixed in 3.3.2.

### [CVE-2020-15184](https://cve.now/CVE-2020-15184): Aliases are never checked in Helm

- Severity: Low 3.7
- Published: Sep 17, 2020
- Affected: from 3.0.0, fixed in 3.3.2.

### [CVE-2020-4053](https://cve.now/CVE-2020-4053): Path Traversal in Helm Plugin Archive

- Severity: Low 3.7
- Published: Jun 16, 2020
- Affected: from 3.0.0, fixed in 3.2.4.

### [CVE-2020-11013](https://cve.now/CVE-2020-11013): lookup Function Information Discolosure in Helm

- Severity: High 8.5
- Published: Apr 24, 2020
- Affected: from 3.0.0, fixed in 3.1.3.

### [CVE-2020-7919](https://cve.now/CVE-2020-7919): Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows…

- Severity: Unrated
- Published: Mar 16, 2020
- Affected: from 3.0.0, fixed in 3.1.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/helm.sh/helm/v3
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.