CVE-2025-32386: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
First published: Wed Apr 09 2025(Updated: )
A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination. ### Impact A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. ### Patches This issue has been resolved in Helm v3.17.3. ### Workarounds Ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination. ### For more information Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document. ### Credits Disclosed by Jakub Ciolek at AlphaSense.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Helm | <3.17.3 | |
| go/helm.sh/helm/v3 | <3.17.3 | 3.17.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32386?
CVE-2025-32386 is considered a high severity vulnerability due to the potential for memory exhaustion leading to application termination.
How do I fix CVE-2025-32386?
To address CVE-2025-32386, upgrade Helm to version 3.17.4 or later where the vulnerability has been mitigated.
What products are affected by CVE-2025-32386?
CVE-2025-32386 affects Helm versions up to and including 3.17.3.
What types of attacks can CVE-2025-32386 facilitate?
CVE-2025-32386 could facilitate denial-of-service attacks by exhausting memory resources through specially crafted chart files.
Is there a workaround for CVE-2025-32386 if upgrading is not immediately possible?
As a temporary workaround for CVE-2025-32386, avoid using untrusted or unknown chart archives to prevent potential memory exhaustion.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4hfp-h4cw-hj8p
- alias/CVE-2025-32386
- agent/references
- agent/softwarecombine
- agent/description
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/event
- collector/github-advisory
- vendor/helm
- canonical/helm
- package-manager/go