Skip to content
OpenAdvisories
Medium · 5.3 CVE-2022-23524 BIT-helm-2022-23524EUVD-2022-7540GHSA-6rx9-889q-vv2rGO-2022-1167

Helm vulnerable to Denial of service through string value parsing

Published Dec 15, 2022 · Updated Apr 18, 2025 · Assigned by GitHub_M

Description

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

Affected products

VendorProductAffectedFixed
helm helm < v3.10.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES 15 SP4 helm 3.10.3-150000.1.13.1 SUSE-SU-2022:4606-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed helm 3.10.3-2.1 openSUSE-SU-2024:12572-1
openSUSE Tumbleweed helm3 3.19.2-1.1 openSUSE-SU-2025:15779-1
openSUSE Leap 15.4 helm 3.10.3-150000.1.13.1 SUSE-SU-2022:4606-1
openSUSE Leap 15.3 helm 3.10.3-150000.1.13.1 SUSE-SU-2022:4606-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) helm 3.10.3-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go helm.sh/helm/v3 < 3.10.3 3.10.3 GHSA-6rx9-889q-vv2r

Advisories 5

References