Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-55199 BIT-helm-2025-55199EUVD-2025-24647GHSA-9h84-qmv7-982pGO-2025-3887

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Published Aug 13, 2025 · Updated Aug 14, 2025 · Assigned by GitHub_M

Vendor: helm Product: helm Package: cerbos Package: cerbos-compat Package: cerbosctl Package: cerbosctl-compat Package: cert-manager-cmctl Package: chart-testing Package: chartmuseum Package: cilium-cli Package: cluster-api-helm-controller Package: cluster-api-helm-controller-compat Package: eksctl Package: envoy-gateway Package: envoy-gateway-compat Package: envoy-gateway-egctl Package: flux Package: flux-helm-controller Package: flux-helm-controller-iamguarded-compat Package: flux-source-controller Package: flux-source-controller-iamguarded-compat Package: gem-check Package: gosh Package: header-check Package: headlamp Package: headlamp-compat Package: helm Package: helm-docs Package: helm-mapkubeapis Package: helm-operator Package: helm-operator-compat Package: helm-push Package: helm-set-status Package: helm.sh/helm Package: helm.sh/helm/v3 Package: help-check Package: istio-pilot-agent-1.25 Package: istio-pilot-agent-1.25-compat Package: k8sgpt Package: k8ssandra-client Package: k8ssandra-client-compat Package: k9s Package: kargo Package: kargo-oci-compat Package: kots Package: kots-compat Package: kots-symlink-compat Package: kubescape Package: kubevela-vela-cli Package: kubevela-vela-core Package: ldd-check Package: linkerd2 Package: linkerd2-cli Package: linkerd2-controller Package: linkerd2-controller-compat Package: linkerd2-debug Package: linkerd2-metrics-api Package: linkerd2-metrics-api-compat Package: linkerd2-proxy-identity Package: linkerd2-tap Package: linkerd2-tap-compat Package: linkerd2-web Package: no-docs-check Package: nova Package: nova-compat Package: package-type-check Package: pluto Package: pluto-compat Package: rancher-fleet Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-fleet-termination-log Package: symlink-check Package: syspeek Package: trivy Package: trivy-operator Package: tw Package: tw-pip-check Package: twt Package: usrmerge-tool Package: ver-check Package: verify-service Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Go Ecosystem: Wolfi

Description

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.

Affected products

VendorProductAffectedFixed
helm helm < 3.18.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 helm 3.20.2-150000.1.71.2 SUSE-SU-2026:1483-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 helm 3.20.2-160000.1.1 SUSE-SU-2026:21434-1
SLES 16.0 helm 3.20.2-160000.1.1 SUSE-SU-2026:21434-1
SLE Micro 6.2 helm 3.20.2-160000.1.1 SUSE-SU-2026:21461-1
SLE Micro 5.5 helm 3.20.2-150000.1.71.2 SUSE-SU-2026:1483-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250818T190335-1.1 openSUSE-SU-2025:15469-1
openSUSE Tumbleweed helm 4.1.1-3.1 openSUSE-SU-2026:10318-1
openSUSE Tumbleweed helm3 3.20.0-2.1 openSUSE-SU-2026:10319-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) helm No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cerbos +3 0.46.0-r2 —
Wolfi rolling cert-manager-cmctl 2.3.0-r4 —
Wolfi rolling chart-testing 3.13.0-r6 —
Wolfi rolling chartmuseum 0.16.3-r6 —
Wolfi rolling cilium-cli 0.18.6-r2 —
Wolfi rolling cluster-api-helm-controller +1 0.3.2-r5 —
Wolfi rolling eksctl 0.214.0-r0 —
Wolfi rolling envoy-gateway +2 1.5.0-r1 —
Wolfi rolling flux 2.6.4-r4 —
Wolfi rolling flux-helm-controller +1 1.3.0-r7 —
Wolfi rolling flux-source-controller +1 1.6.2-r4 —
Wolfi rolling headlamp +1 0.34.0-r1 —
Wolfi rolling helm-docs 1.14.2-r13 —
Wolfi rolling helm-mapkubeapis 0.6.1-r3 —
Wolfi rolling helm-operator +1 1.41.1-r3 —
Wolfi rolling helm-push 0.10.4-r33 —
Wolfi rolling helm-set-status 0.3.0-r3 —
Wolfi rolling istio-pilot-agent-1.25 +1 1.25.4-r2 —
Wolfi rolling k8sgpt 0.4.36-r1 —
Wolfi rolling k8ssandra-client +1 0.8.2-r1 —
Wolfi rolling k9s 0.50.9-r5 —
Wolfi rolling kargo +1 1.7.2-r1 —
Wolfi rolling kots +2 1.126.0-r0 —
Wolfi rolling kubescape 3.0.37-r2 —
Wolfi rolling kubevela-vela-cli +1 No fix yet —
Wolfi rolling linkerd2 +10 25.8.3-r0 —
Wolfi rolling nova +1 3.11.7-r2 —
Wolfi rolling pluto +1 5.22.3-r1 —
Wolfi rolling rancher-fleet +4 0.13.0-r2 —
Wolfi rolling trivy 0.65.0-r2 —
Wolfi rolling trivy-operator 0.28.0-r1 —
Wolfi rolling tw +14 0.0.25-r0 —
Wolfi rolling zarf 0.60.0-r1 —
Wolfi rolling zot 2.1.7-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go helm.sh/helm all versions — GO-2025-3887
Go helm.sh/helm/v3 < 3.18.5 3.18.5 GHSA-9h84-qmv7-982p

Advisories 8

References