Skip to content
Log inStart free trial

GHSA-f9f8-9pmf-xv68 BIT-helm-2025-55198 CVE-2025-55198 GO-2025-3888

Helm May Panic Due To Incorrect YAML Content

Medium Go
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.33%
Chance of exploitation in the next 30 days. Higher than 26.73% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-908 Use of Uninitialized Resource
Fix
3.18.5
Upgrade helm.sh/helm/v3 to this version or later

Description

A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.

Impact

There are two areas of YAML validation that were impacted. First, when a Chart.yaml file had a null maintainer or the child or parent of a dependencies import-values could be parsed as something other than a string, helm lint would panic. Second, when an index.yaml had an empty entry in the list of chart versions Helm would panic on interactions with that repository.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Ensure YAML files are formatted as Helm expects prior to processing them with Helm.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Affected versions

Go

PackageVulnerableFixed in
helm.sh/helm
all versions
 No fix yet
helm.sh/helm/v3
< 3.18.5
3.18.5

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

helm.sh/helm/v3 Go → 3.18.5

go
go get helm.sh/helm/v3@v3.18.5 && go mod tidy

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Weakness

CWE-908: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

How to prevent it
  • Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
  • Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Implementation: Avoid race conditions (CWE-362) during initialization routines.
  • Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-hr2v-4r36-88hr
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium Also affects helm.sh/helm/v3
GHSA-9h84-qmv7-982p
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
Medium Also affects helm.sh/helm
GHSA-557j-xg8c-q2mm
Helm vulnerable to Code Injection through malicious chart.yaml content
High Also affects helm.sh/helm/v3
GHSA-5xqw-8hwv-wg92
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
Medium Also affects helm.sh/helm/v3
GHSA-4hfp-h4cw-hj8p
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
Medium Also affects helm.sh/helm/v3
GHSA-r53h-jv2g-vpx6
Helm's Missing YAML Content Leads To Panic
High Also affects helm.sh/helm/v3
GHSA-v53g-5gjp-272r
Helm dependency management path traversal
Medium Also affects helm.sh/helm/v3
GHSA-pwcw-6f5g-gxf8
Helm vulnerable to information disclosure via getHostByName Function
Medium Also affects helm.sh/helm/v3
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor