Stack Overflow Vulnerability in Helm Package Manager for Kubernetes
CVE-2025-32387

6.5MEDIUM

Key Information:

Vendor

Helm

Status
Helm
Vendor
CVE Published:
9 April 2025

What is CVE-2025-32387?

Helm, a package manager for Kubernetes, is susceptible to a stack overflow vulnerability due to a maliciously crafted JSON Schema file. This file can contain a deeply nested chain of references, which triggers extensive parser recursion, ultimately exceeding the stack size limit. Users are urged to update to Helm version 3.17.3 or later to address this issue and enhance the security of their Kubernetes environments.

Affected Version(s)

helm < 3.17.3

References

https://github.com/helm/helm/security/advisories/GHSA-5xq...
x_refsource_CONFIRM
https://github.com/helm/helm/commit/d8ca55fc669645c10c068...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.