Description
Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| helm | helm | < 3.17.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | helm | No fix yet | — |
| Ubuntu 26.04 LTS | helm | No fix yet | — |
| Ubuntu 25.10 | helm | No fix yet | — |
| Ubuntu 24.04 LTS | helm | No fix yet | — |
| Ubuntu 22.04 LTS | helm | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | helm | No fix yet | — |
| Ubuntu 18.04 LTS | helm | No fix yet | — |
| Ubuntu 16.04 LTS | helm | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | helm-mirror | 0.3.1-150000.1.18.2 | SUSE-SU-2025:01830-2 |
| SLES 15 SP6 | helm-mirror | 0.3.1-150000.1.18.2 | SUSE-SU-2025:01830-1 |
| SLES 15 SP5 | terraform-provider-aws | 3.11.0-150200.6.18.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-external | 2.0.0-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-google | 3.43.0-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-helm | 2.9.0-150200.6.23.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-local | 2.0.0-150200.6.17.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-null | 3.0.0-150200.6.18.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-random | 3.0.0-150200.6.15.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP5 | terraform-provider-tls | 3.0.0-150200.5.15.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-aws | 3.11.0-150200.6.18.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-external | 2.0.0-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-google | 3.43.0-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-helm | 2.9.0-150200.6.23.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-local | 2.0.0-150200.6.17.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-null | 3.0.0-150200.6.18.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-random | 3.0.0-150200.6.15.1 | SUSE-SU-2026:3056-1 |
| SLES 15 SP4 | terraform-provider-tls | 3.0.0-150200.5.15.1 | SUSE-SU-2026:3056-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250410T162706-1.1 | openSUSE-SU-2025:14995-1 |
| openSUSE Leap 15.6 | helm-mirror | 0.3.1-150000.1.18.2 | SUSE-SU-2025:01830-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cert-manager | 1.12.15-4 | — |
| Azure Linux 2 (CBL-Mariner) | cert-manager | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cert-manager-cmctl | 2.1.1-r11 | — |
| Wolfi rolling | chart-testing | 3.12.0-r2 | — |
| Wolfi rolling | chartmuseum | 0.16.2-r18 | — |
| Wolfi rolling | cilium-cli | 0.18.3-r1 | — |
| Wolfi rolling | cluster-api-helm-controller | 0.4.1-r1 | — |
| Wolfi rolling | eksctl | 0.207.0-r3 | — |
| Wolfi rolling | flux | 2.5.1-r5 | — |
| Wolfi rolling | flux-helm-controller +1 | 1.2.0-r7 | — |
| Wolfi rolling | flux-source-controller +1 | 1.5.0-r42 | — |
| Wolfi rolling | helm-docs | 1.14.2-r8 | — |
| Wolfi rolling | helm-operator +1 | 1.39.2-r1 | — |
| Wolfi rolling | helm-push | 0.10.4-r26 | — |
| Wolfi rolling | k8ssandra-client | 0.8.3-r1 | — |
| Wolfi rolling | k9s | 0.50.3-r0 | — |
| Wolfi rolling | kots +2 | 1.124.14-r1 | — |
| Wolfi rolling | kubescape | 3.0.34-r1 | — |
| Wolfi rolling | kubevela-vela-cli +1 | No fix yet | — |
| Wolfi rolling | pluto +1 | 5.21.3-r3 | — |
| Wolfi rolling | rancher-helm-3 | 3.19.0-r1 | — |
| Wolfi rolling | trivy | 0.61.0-r1 | — |
| Wolfi rolling | tw +14 | 0.0.13-r0 | — |
| Wolfi rolling | zarf | 0.51.0-r1 | — |
| Wolfi rolling | zot | 2.1.2-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | helm.sh/helm/v3 | < 3.17.3 | 3.17.3 | GHSA-5xqw-8hwv-wg92 |
Advisories 4
- SUSE-SU-2026:3056-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls SUSE / openSUSE Security Updates · Jul 16, 2026
- SUSE-SU-2025:01830-1 Security update for helm-mirror SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:01830-2 Security update for helm-mirror SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14995-1 govulncheck-vulndb-0.0.20250410T162706-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026