{"id":"CVE-2025-32387","aliases":["AZL-59979","AZL-60172","BIT-helm-2025-32387","EUVD-2025-10671","GHSA-5xqw-8hwv-wg92","GO-2025-3602","SUSE-SU-2025:01830-1","SUSE-SU-2025:01830-2","SUSE-SU-2026:3056-1","UBUNTU-CVE-2025-32387","openSUSE-SU-2025:14995-1"],"status":"published","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00501,"percentile":0.43237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-674"],"published":"2025-04-09T22:28:33Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"helm.sh/helm/v3","fixed_in":["3.17.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-4"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"helm","fixed_in":["3.17.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.2-27"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"helm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.17.3"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.17.3"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.17.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.18.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.18.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.18.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-1","1.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-1","2.8.5-1","2.8.6-1","2.8.7-1","2.8.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2-1","3.5.0-3","3.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.0-2","3.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.4-2","4.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-3","4.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-1","4.0.6-1","4.0.6-2","4.0.6-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250410T162706-1.1"}]}],"bundled":2}],"products":[{"vendor":"helm","product":"helm"}],"references":[{"url":"https://github.com/helm/helm/security/advisories/GHSA-5xqw-8hwv-wg92","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32387","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5xqw-8hwv-wg92"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32387.json","tags":["advisory"]},{"url":"https://github.com/helm/helm","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501830-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241028","tags":["report"]},{"url":"https://bugzilla.suse.com/1241031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32387","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501830-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208300","tags":["report"]},{"url":"https://bugzilla.suse.com/1241030","tags":["report"]},{"url":"https://bugzilla.suse.com/1241033","tags":["report"]},{"url":"https://bugzilla.suse.com/1241728","tags":["report"]},{"url":"https://bugzilla.suse.com/1251365","tags":["report"]},{"url":"https://bugzilla.suse.com/1251559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253508","tags":["report"]},{"url":"https://bugzilla.suse.com/1253517","tags":["report"]},{"url":"https://bugzilla.suse.com/1253797","tags":["report"]},{"url":"https://bugzilla.suse.com/1253799","tags":["report"]},{"url":"https://bugzilla.suse.com/1253980","tags":["report"]},{"url":"https://bugzilla.suse.com/1253983","tags":["report"]},{"url":"https://bugzilla.suse.com/1258096","tags":["report"]},{"url":"https://bugzilla.suse.com/1260139","tags":["report"]},{"url":"https://bugzilla.suse.com/1260149","tags":["report"]},{"url":"https://bugzilla.suse.com/1260180","tags":["report"]},{"url":"https://bugzilla.suse.com/1263247","tags":["report"]},{"url":"https://bugzilla.suse.com/1263313","tags":["report"]},{"url":"https://bugzilla.suse.com/1263357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263411","tags":["report"]},{"url":"https://bugzilla.suse.com/1263445","tags":["report"]},{"url":"https://bugzilla.suse.com/1263515","tags":["report"]},{"url":"https://bugzilla.suse.com/1263606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264862","tags":["report"]},{"url":"https://bugzilla.suse.com/1264888","tags":["report"]},{"url":"https://bugzilla.suse.com/1264938","tags":["report"]},{"url":"https://bugzilla.suse.com/1266051","tags":["report"]},{"url":"https://bugzilla.suse.com/1266057","tags":["report"]},{"url":"https://bugzilla.suse.com/1266086","tags":["report"]},{"url":"https://bugzilla.suse.com/1266112","tags":["report"]},{"url":"https://bugzilla.suse.com/1266122","tags":["report"]},{"url":"https://bugzilla.suse.com/1266127","tags":["report"]},{"url":"https://bugzilla.suse.com/1266132","tags":["report"]},{"url":"https://bugzilla.suse.com/1266150","tags":["report"]},{"url":"https://bugzilla.suse.com/1266160","tags":["report"]},{"url":"https://bugzilla.suse.com/1266477","tags":["report"]},{"url":"https://bugzilla.suse.com/1266482","tags":["report"]},{"url":"https://bugzilla.suse.com/1266541","tags":["report"]},{"url":"https://bugzilla.suse.com/1266547","tags":["report"]},{"url":"https://bugzilla.suse.com/1267058","tags":["report"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-32387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32387","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/E43FPQVMRXXDJFNVP6BBWLBUQXMXBJ3W/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-32387","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T22:28:33.476Z","modified":"2025-04-10T14:58:47.796Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121","CWE-674"],"updated_at":"2026-11-02T14:32:46.42892Z"}],"euvd":[{"id":"EUVD-2025-10671","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T22:28:33Z","modified":"2025-04-10T14:58:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:36.709643Z"}],"ghsa":[{"id":"GHSA-5xqw-8hwv-wg92","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow","description":"A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.\n\n### Impact\nA JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. \n\n### Patches\nThis issue has been resolved in Helm v3.17.3.\n\n### Workarounds\nEnsure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.\n\n### For more information\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\nDisclosed by Jakub Ciolek at AlphaSense.","status":"published","published":"2025-04-10T13:48:31Z","modified":"2025-04-10T13:48:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121","CWE-674"],"updated_at":"2026-11-02T14:38:38.344711Z"}],"nvd":[{"id":"CVE-2025-32387","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T23:15:37.903Z","modified":"2026-06-17T09:11:55.21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121","CWE-674"],"updated_at":"2026-11-02T14:11:00.087098Z"}],"osv":[{"id":"CVE-2025-32387","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T22:28:33.476Z","modified":"2026-10-28T02:30:22.603036815Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121","CWE-674"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-5xqw-8hwv-wg92","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow","description":"A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.\n\n### Impact\nA JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. \n\n### Patches\nThis issue has been resolved in Helm v3.17.3.\n\n### Workarounds\nEnsure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.\n\n### For more information\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\nDisclosed by Jakub Ciolek at AlphaSense.","status":"published","published":"2025-04-10T13:48:31Z","modified":"2026-09-10T03:50:57.093727559Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121","CWE-674"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"UBUNTU-CVE-2025-32387","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T23:15:00Z","modified":"2026-10-17T12:57:27.047557569Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"AZL-59979","title":"CVE-2025-32387 affecting package cert-manager for versions less than 1.12.15-4","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T23:15:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"AZL-60172","title":"CVE-2025-32387 affecting package cert-manager 1.11.2-27","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-09T23:15:37Z","modified":"2026-04-21T04:37:22.439705Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"BIT-helm-2025-32387","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow","description":"Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.","status":"published","published":"2025-04-11T19:13:06.497Z","modified":"2026-09-08T08:48:23.040922831Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3602","title":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm","description":"Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm","status":"published","published":"2025-04-10T16:27:06Z","modified":"2026-02-04T04:18:31.960543Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14995-1","title":"govulncheck-vulndb-0.0.20250410T162706-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250410T162706-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-15T00:00:00Z","modified":"2026-02-04T02:46:40.522815Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:01830-1","title":"Security update for helm-mirror","description":"This update for helm-mirror fixes the following issues:\n\n- CVE-2025-32386: Fixed denial of service due to memory exhaustion after loading a specially crafter chart (bsc#1241028)\n- CVE-2025-32387: Fixed stack overflow due to parser recursion that can exceed the stack size limit (bsc#1241031)\n","status":"published","published":"2025-06-06T15:17:40Z","modified":"2026-02-04T03:28:06.400897Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01830-2","title":"Security update for helm-mirror","description":"This update for helm-mirror fixes the following issues:\n\n- CVE-2025-32386: Fixed denial of service due to memory exhaustion after loading a specially crafter chart (bsc#1241028)\n- CVE-2025-32387: Fixed stack overflow due to parser recursion that can exceed the stack size limit (bsc#1241031)\n","status":"published","published":"2025-07-08T09:47:18Z","modified":"2026-02-04T03:25:06.515237Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2026:3056-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241728).\n- CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).\n- CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents\n  (bsc#1251365).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type\n  in response to a key listing or signing request (bsc#1253508 bsc#1253517).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1253980 bsc#1253983).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253797 bsc#1253799).\n- CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by\n  `html.ParseFragment` (bsc#1251559).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267058).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx`\n  files can lead to the consumption of corrupted files (bsc#1258096).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path` \n  pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112\n  bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an\n  out-of-bounds read and potential information disclosure (bsc#1263313).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service\n  via stack exhaustion (bsc#1263247).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n","status":"published","published":"2026-07-15T13:28:46Z","modified":"2026-07-16T10:00:15.0086061Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}