Every CVE Search/ Get API key

CVE-2026-35206

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

4.8 MediumFix available

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.21%Up 0.2 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Record
CVE-2026-35206
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-21100 4.8

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Record
EUVD-2026-21100
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hr2v-4r36-88hr 4.8

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name.

Impact

The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory <output dir>/, instead of the expected <output dir>/<chart name>/, potentially overwriting the contents of the targeted directory.

Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed.

Patches

This issue has been resolved in Helm v3.20.2 and v4.1.3

A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected.

Workarounds

Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the pull --untar flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory.

Credits

Oleh Konko @1seal

Record
GHSA-hr2v-4r36-88hr
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
NVD 4.8

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Record
CVE-2026-35206
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSV 4.8

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Record
CVE-2026-35206
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-hr2v-4r36-88hr 4.8

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name.

Impact

The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory <output dir>/, instead of the expected <output dir>/<chart name>/, potentially overwriting the contents of the targeted directory.

Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed.

Patches

This issue has been resolved in Helm v3.20.2 and v4.1.3

A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected.

Workarounds

Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the pull --untar flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory.

Credits

Oleh Konko @1seal

Record
GHSA-hr2v-4r36-88hr
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
Show 17 moreShow less
OSVBIT-helm-2026-35206 No score

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Record
BIT-helm-2026-35206
Updated
2026-11-02
OSVGO-2026-5435 No score

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

Record
GO-2026-5435
Updated
2026-11-02
OSVopenSUSE-SU-2026:10532-1 No score

helm3-3.20.2-1.1 on GA media

These are all security issues fixed in the helm3-3.20.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10532-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10538-1 No score

helm-4.1.4-2.1 on GA media

These are all security issues fixed in the helm-4.1.4-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10538-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20655-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.20.2.

Security issued fixed:

  • CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
  • CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938).

Other updates and bugfixes:

  • Version 3.20.1:
    • chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot])
    • add image index test 90e1056 (Pedro T�rres)
    • fix pulling charts from OCI indices 911f2e9 (Pedro T�rres)
    • Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai)
    • Fix import 45c12f7 (Evans Mungai)
    • Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai)
    • Fix lint warning 09f5129 (Evans Mungai)
    • Preserve nil values in chart already 417deb2 (Evans Mungai)
    • fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai)
  • Version 3.20.0:
    • SDK: bump k8s API versions to v0.35.0
    • v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564
    • v3 backport: Bump Go version to v1.25
    • bump version to v3.20
    • chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0
    • chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    • chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0
    • chore(deps): bump the k8s-io group with 7 updates
    • [dev-v3] Replace deprecated NewSimpleClientset
    • [dev-v3] Bump Go v1.25, golangci-lint v2
    • chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0
    • chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30
    • fix(rollback): errors.Is instead of string comp
    • fix(uninstall): supersede deployed releases
    • Use latest patch release of Go in releases
    • chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0
    • chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0
    • chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0
    • chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    • chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1
    • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    • chore(deps): bump github.com/cyphar/filepath-securejoin
    • chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0
    • chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0
    • Remove dev-v3 helm-latest-version publish
    • chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 1.7.28 to 1.7.29
    • Revert "pkg/registry: Login option for passing TLS config in memory"
    • jsonschema: warn and ignore unresolved URN $ref to match v3.18.4
    • Fix helm pull untar dir check with repo urls
    • chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0
    • chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0
    • chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0
    • [backport] fix: get-helm-3 script use helm3-latest-version
    • pkg/registry: Login option for passing TLS config in memory
    • Fix deprecation warning
    • chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0
    • chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0
    • Avoid "panic: interface conversion: interface {} is nil"
    • bump version to v3.19.0
    • chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
    • fix: set repo authorizer in registry.Client.Resolve()
    • fix null merge
    • Add timeout flag to repo add and update flags
  • Version 3.19.5:
    • Fixed bug where removing subchart value via override resulted in warning #31118
    • Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #12556
    • fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals)
    • fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals)
    • fix null merge 578564e (Ben Foster)
  • Version 3.19.4:
    • Use latest…
Record
openSUSE-SU-2026:20655-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
openSUSE-SU-2026:21551-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21983-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21983-1
Updated
2026-11-02
OSVSUSE-SU-2026:1483-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2025-55199: crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
  • CVE-2026-35206: files written to unexpected directory via specially crafted Chart(bsc#1261938).

Changes for helm:

  • Update to version 3.20.2
Record
SUSE-SU-2026:1483-1
Updated
2026-11-02
OSVSUSE-SU-2026:21434-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.20.2.

Security issued fixed:

  • CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
  • CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938).

Other updates and bugfixes:

  • Version 3.20.1:
    • chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot])
    • add image index test 90e1056 (Pedro Torres)
    • fix pulling charts from OCI indices 911f2e9 (Pedro Torres)
    • Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai)
    • Fix import 45c12f7 (Evans Mungai)
    • Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai)
    • Fix lint warning 09f5129 (Evans Mungai)
    • Preserve nil values in chart already 417deb2 (Evans Mungai)
    • fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai)
  • Version 3.20.0:
    • SDK: bump k8s API versions to v0.35.0
    • v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564
    • v3 backport: Bump Go version to v1.25
    • bump version to v3.20
    • chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0
    • chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    • chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0
    • chore(deps): bump the k8s-io group with 7 updates
    • [dev-v3] Replace deprecated NewSimpleClientset
    • [dev-v3] Bump Go v1.25, golangci-lint v2
    • chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0
    • chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30
    • fix(rollback): errors.Is instead of string comp
    • fix(uninstall): supersede deployed releases
    • Use latest patch release of Go in releases
    • chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0
    • chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0
    • chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0
    • chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    • chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1
    • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    • chore(deps): bump github.com/cyphar/filepath-securejoin
    • chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0
    • chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0
    • Remove dev-v3 helm-latest-version publish
    • chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 1.7.28 to 1.7.29
    • Revert "pkg/registry: Login option for passing TLS config in memory"
    • jsonschema: warn and ignore unresolved URN $ref to match v3.18.4
    • Fix helm pull untar dir check with repo urls
    • chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0
    • chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0
    • chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0
    • [backport] fix: get-helm-3 script use helm3-latest-version
    • pkg/registry: Login option for passing TLS config in memory
    • Fix deprecation warning
    • chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0
    • chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0
    • Avoid "panic: interface conversion: interface {} is nil"
    • bump version to v3.19.0
    • chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
    • fix: set repo authorizer in registry.Client.Resolve()
    • fix null merge
    • Add timeout flag to repo add and update flags
  • Version 3.19.5:
    • Fixed bug where removing subchart value via override resulted in warning #31118
    • Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #12556
    • fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals)
    • fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals)
    • fix null merge 578564e (Ben Foster)
  • Version 3.19.4:
    • Use latest…
Record
SUSE-SU-2026:21434-1
Updated
2026-11-02
OSVSUSE-SU-2026:21461-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.20.2.

Security issued fixed:

  • CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
  • CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938).

Other updates and bugfixes:

  • Version 3.20.1:
    • chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot])
    • add image index test 90e1056 (Pedro Torres)
    • fix pulling charts from OCI indices 911f2e9 (Pedro Torres)
    • Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai)
    • Fix import 45c12f7 (Evans Mungai)
    • Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai)
    • Fix lint warning 09f5129 (Evans Mungai)
    • Preserve nil values in chart already 417deb2 (Evans Mungai)
    • fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai)
  • Version 3.20.0:
    • SDK: bump k8s API versions to v0.35.0
    • v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564
    • v3 backport: Bump Go version to v1.25
    • bump version to v3.20
    • chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0
    • chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    • chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0
    • chore(deps): bump the k8s-io group with 7 updates
    • [dev-v3] Replace deprecated NewSimpleClientset
    • [dev-v3] Bump Go v1.25, golangci-lint v2
    • chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0
    • chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30
    • fix(rollback): errors.Is instead of string comp
    • fix(uninstall): supersede deployed releases
    • Use latest patch release of Go in releases
    • chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0
    • chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0
    • chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0
    • chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    • chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1
    • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    • chore(deps): bump github.com/cyphar/filepath-securejoin
    • chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0
    • chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0
    • Remove dev-v3 helm-latest-version publish
    • chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 1.7.28 to 1.7.29
    • Revert "pkg/registry: Login option for passing TLS config in memory"
    • jsonschema: warn and ignore unresolved URN $ref to match v3.18.4
    • Fix helm pull untar dir check with repo urls
    • chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0
    • chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0
    • chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0
    • [backport] fix: get-helm-3 script use helm3-latest-version
    • pkg/registry: Login option for passing TLS config in memory
    • Fix deprecation warning
    • chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0
    • chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0
    • Avoid "panic: interface conversion: interface {} is nil"
    • bump version to v3.19.0
    • chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
    • fix: set repo authorizer in registry.Client.Resolve()
    • fix null merge
    • Add timeout flag to repo add and update flags
  • Version 3.19.5:
    • Fixed bug where removing subchart value via override resulted in warning #31118
    • Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #12556
    • fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals)
    • fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals)
    • fix null merge 578564e (Ben Foster)
  • Version 3.19.4:
    • Use latest…
Record
SUSE-SU-2026:21461-1
Updated
2026-11-02
OSVSUSE-SU-2026:21628-1 No score

Security update for helm

This update for helm fixes the following issues

Security issues:

  • CVE-2025-55199: crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).

Non security issue:

  • Update to version 3.20.2
  • Fix packages for %suse_version bump (jsc#PED-15794).
Record
SUSE-SU-2026:21628-1
Updated
2026-11-02
OSVSUSE-SU-2026:21635-1 No score

Security update for helm

This update for helm fixes the following issues

Security issues:

  • CVE-2025-55199: crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).

Non security issue:

  • Update to version 3.20.2
  • Fix packages for %suse_version bump (jsc#PED-15794).
Record
SUSE-SU-2026:21635-1
Updated
2026-11-02
OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
SUSE-SU-2026:23216-1
Updated
2026-11-02
OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
SUSE-SU-2026:23227-1
Updated
2026-11-02
OSVSUSE-SU-2026:23973-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23973-1
Updated
2026-11-02
OSVSUSE-SU-2026:23984-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23984-1
Updated
2026-11-02
OSVSUSE-SU-2026:24282-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

  • update to 4.3.0:
  • feat: Add duration functions
  • feat(engine): add debug logging when lookup returns empty
  • feat: add ownership verification before deleting resources
  • feat: honor SOURCE_DATE_EPOCH for chart archives
  • feat(rollback): add --description flag to provide rollback reason
  • fix (internal/plugin): remove zero-width spaces from plugin name comment
  • fix(loader): do not drop values files ending at a 4096-byte boundary
  • fix(chart): normalize StampModTimes timestamp to UTC/truncate
  • Chart.lock reproducibility test
  • fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
  • fix(template): regression - route registry messages to stderr in template and show
  • refactor: lower resync period from one hour to 3 minutes
  • perf: enable concurrent status computation to prevent multi-minute delays
  • fix: Improve error reporting for helm template --debug with --show-only- #31185
  • fix: fetch logs from all containers in test pods- #32099
  • fix(provenance): check error return in Digest and encodeRelease- #32136
  • fix panic on repeated IsReachable calls- #32184
  • fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211
  • Fix missing conflict retry with server-side apply- #32088
  • Properly format the extra field in gzipped…
Record
SUSE-SU-2026:24282-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
helm.sh/helm/v4
Go
 through 4.1.3
4.1.4
helm.sh/helm/v3
Go
 through 3.20.1
3.20.2
helm
Bitnami
 before 3.20.2, 4.0.0 up to 4.1.4
3.20.24.1.4
helm.sh/helm/v4
Go
 before 4.1.4
4.1.4
helm.sh/helm/v3
Go
 before 3.20.2
3.20.2
helm
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 3.20.2-150000.1.71.2
3.20.2-150000.1.71.2
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 2 CVEs
 before 3.20.2-150000.1.71.2
3.20.2-150000.1.71.2
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 3.20.2-150000.1.71.2
3.20.2-150000.1.71.2
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 3.20.2-160000.1.1
3.20.2-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 3.20.2-160000.1.1
3.20.2-160000.1.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
helm
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 3.20.2-160000.1.1
3.20.2-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 77 CVEs
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 77 CVEs
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 20 CVEs
 before 4.3.0-slfo.1.1_1.1
4.3.0-slfo.1.1_1.1
helm3
openSUSE:Tumbleweed
 before 3.20.2-1.1
3.20.2-1.1
helm
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 4.1.4-2.1
4.1.4-2.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 77 CVEs
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
helm
openSUSE:Leap 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35206 is a medium vulnerability (CVSS 4.8) in Helm, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in helm.sh/helm/v4 4.1.4.

References

Show 122 moreShow less
This page doesn't list everything

Left out here: the rest of 7 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open