CVE-2025-32386: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Analyzed

AliasesUBUNTU-CVE-2025-32386CGA-23qq-24q9-9x26CGA-253x-674g-3hxm+213 more

Published 09-04-2025Last modified 10-04-2025

Vulnerability summary

CVE-2025-32386 is a medium (CVSS 6.5) vulnerability in helm. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.47%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

09-04-2025
PublishedVulnerability first disclosed.
10-04-2025
Last modifiedVulnerability information updated.

Description

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issue has been resolved in Helm v3.17.3.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.5

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard106 products

cert-manager-cmctl< 2.1.1-r11
cert-manager-cmctl-fips< 2.1.1-r10
chart-testing< 3.12.0-r2
chart-testing-fips< 3.12.0-r3
chartmuseum< 0.16.2-r18

chartmuseum-fips< 0.16.2-r16
cilium-cli< 0.18.3-r1
cluster-api-helm-controller< 0.4.1-r1
cluster-api-helm-controller-fips< 0.4.1-r1 | < 0.4.1-r2
consul-k8s-1.7< 1.7.1-r1
consul-k8s-1.7-cli< 1.7.1-r1
consul-k8s-fips-1.4-cli< 1.4.10-r25
eksctl< 0.207.0-r3
flux< 2.5.1-r5
flux-2.5< 2.5.1-r6
flux-2.5-compat< 2.5.1-r6
flux-fips-2.5< 2.5.1-r5
flux-fips-2.5-compat< 2.5.1-r5
flux-helm-controller< 1.2.0-r7
flux-helm-controller-fips< 1.2.0-r5
flux-helm-controller-iamguarded-compat< 1.2.0-r7
flux-source-controller< 1.5.0-r42
flux-source-controller-fips< 1.5.0-r8
flux-source-controller-iamguarded-compat< 1.5.0-r42
gem-check< 0.0.13-r0
gosh< 0.0.13-r0
harbor-2.11< 2.11.2-r8
harbor-2.11-exporter< 2.11.2-r8
harbor-2.11-jobservice< 2.11.2-r8
harbor-2.11-photon-registry< 2.11.2-r8
harbor-2.11-portal< 2.11.2-r8
harbor-2.11-portal-nginx-config< 2.11.2-r8
harbor-2.11-redis-compat< 2.11.2-r8
harbor-2.11-registryctl< 2.11.2-r8
harbor-2.12< 2.12.2-r10
harbor-2.12-exporter< 2.12.2-r10
harbor-2.12-jobservice< 2.12.2-r10
harbor-2.12-photon-registry< 2.12.2-r10
harbor-2.12-portal< 2.12.2-r10
harbor-2.12-portal-nginx-config< 2.12.2-r10
harbor-2.12-redis-compat< 2.12.2-r10
harbor-2.12-registryctl< 2.12.2-r10
harbor-2.9-portal-nginx-config< 2.9.5-r17
harbor-fips-2.11< 2.11.2-r12
harbor-fips-2.11-db< 2.11.2-r12
harbor-fips-2.11-exporter< 2.11.2-r12
harbor-fips-2.11-jobservice< 2.11.2-r12
harbor-fips-2.11-photon-registry< 2.11.2-r12
harbor-fips-2.11-portal< 2.11.2-r12
harbor-fips-2.11-redis-compat< 2.11.2-r12
harbor-fips-2.11-registryctl< 2.11.2-r12
harbor-fips-2.12< 2.12.2-r11
harbor-fips-2.12-db< 2.12.2-r11
harbor-fips-2.12-exporter< 2.12.2-r11
harbor-fips-2.12-jobservice< 2.12.2-r11
harbor-fips-2.12-photon-registry< 2.12.2-r11
harbor-fips-2.12-portal< 2.12.2-r11
harbor-fips-2.12-redis-compat< 2.12.2-r11
harbor-fips-2.12-registryctl< 2.12.2-r11
harbor-fips-2.13< 2.13.0-r1
harbor-fips-2.13-db< 2.13.0-r1
harbor-fips-2.13-exporter< 2.13.0-r1
harbor-fips-2.13-jobservice< 2.13.0-r1
harbor-fips-2.13-photon-registry< 2.13.0-r1
harbor-fips-2.13-portal< 2.13.0-r1
harbor-fips-2.13-redis-compat< 2.13.0-r1
harbor-fips-2.13-registryctl< 2.13.0-r1
header-check< 0.0.13-r0
helm-docs< 1.14.2-r8
helm-operator< 1.39.2-r1
helm-operator-compat< 1.39.2-r1
helm-operator-fips< 1.39.2-r1
helm-operator-fips-compat< 1.39.2-r1
helm-push< 0.10.4-r26
help-check< 0.0.13-r0
k8ssandra-client< 0.8.3-r1 | < 0.8.3-r2
k8ssandra-client-fips< 0.8.3-r2
k9s< 0.50.3-r0
kots< 1.124.14-r1
kots-compat< 1.124.14-r1
kots-symlink-compat< 1.124.14-r1
kubescape< 3.0.34-r1
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kuma-2.7< 2.7.19-r0
kumactl-2.7< 2.7.19-r11
ldd-check< 0.0.13-r0
no-docs-check< 0.0.13-r0
package-type-check< 0.0.13-r0
pluto< 5.21.3-r3
pluto-compat< 5.21.3-r3
rancher-helm-3< 3.19.0-r1
symlink-check< 0.0.13-r0
syspeek< 0.0.13-r0
trivy< 0.61.0-r1
trivy-fips< 0.61.0-r2
tw< 0.0.13-r0
tw-pip-check< 0.0.13-r0
twt< 0.0.13-r0
usrmerge-tool< 0.0.13-r0
ver-check< 0.0.13-r0
verify-service< 0.0.13-r0
zarf< 0.51.0-r1
zot< 2.1.2-r10

Show all 106

Wolfi44 products

cert-manager-cmctl< 2.1.1-r11
chart-testing< 3.12.0-r2
chartmuseum< 0.16.2-r18
cilium-cli< 0.18.3-r1
cluster-api-helm-controller< 0.4.1-r1

Show all 44

Helm1 product

helm< 3.17.3

Helm.sh/helm1 product

v3< 3.17.3

Ubuntu1 product

helmAll versions (No fix recorded)

5 vendors · 153 products

References

7 links

github.com/helm/helm/security/advisories/GHSA-4hfp-h4cw-hj8pX Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7X Refsource MISCREPORTFIXWEBPatch
ubuntu.com/security/CVE-2025-32386REPORT
www.cve.org/CVERecord?id=CVE-2025-32386REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32386.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-32386AdvisoryOval
github.com/helm/helmPACKAGE