CVE-2025-32387

Aliases:GHSA-5xqw-8hwv-wg92BIT-helm-2025-32387GO-2025-3602CGA-2262-5vgm-g8cqCGA-2q22-vm8m-gfg9CGA-2q74-qh8g-xhqfCGA-2vgj-qcm7-4h9cCGA-338r-gxxm-vxqcCGA-35h9-f7mm-5mjcCGA-36cf-w4rm-mx23CGA-3ccm-924p-ph8rCGA-3whc-mwxp-5mr5CGA-4277-h88g-f786CGA-4cxf-4g6v-6w3mCGA-4wr8-h9jw-5xxqCGA-537m-2q9f-g2hpCGA-5c7v-5482-hm7cCGA-5j46-gpgf-wcjgCGA-5jcg-7x79-vvfrCGA-633j-3r67-v33fCGA-6355-j3fx-6xrcCGA-65gj-ffcx-7j5xCGA-69hm-gmcp-jr4cCGA-6f3v-c6g8-vh39CGA-6mqg-2r32-jhp5CGA-6pfv-pp5j-3jj5CGA-6qgp-jwhc-fx9mCGA-6qr8-jx7r-c7vmCGA-6w72-wm5v-g6jgCGA-73h7-j8gr-jf3rCGA-73m7-4x2j-c49hCGA-74r8-v78g-r698CGA-75q6-3m56-qv4xCGA-846m-9chv-j8mpCGA-8cg2-xwv6-226cCGA-8g72-4g98-79v2CGA-8vfg-j9x2-4c2qCGA-97qp-gjw4-hpc9CGA-993m-f882-w6gxCGA-99rq-5275-x892CGA-9g49-qjq8-h6w7CGA-c55r-9hw5-vw7vCGA-ccxv-gm4m-vq2jCGA-cqxj-gj23-qwv8CGA-cr7x-7c59-35g2CGA-f26w-3v5x-wf7qCGA-f94r-qf6c-4q8wCGA-fcqh-m7fj-6xcgCGA-ffm4-3266-wg55CGA-fr26-4r82-m2jvCGA-g3qv-fwgh-rpc3CGA-gqrj-7fc2-mv3wCGA-h555-wc4r-wvrrCGA-h567-hgm3-jm27CGA-h9hf-xvc8-jr8vCGA-hc9j-5mpv-pgw9CGA-hj2v-9hf9-cqjvCGA-hvhv-hrxp-rjwjCGA-j5c3-95jq-3cc2CGA-jg4f-cjxh-g4cgCGA-m9g2-4v5j-jwrjCGA-mjx4-fc46-pvrxCGA-mmf5-hrv5-25x2CGA-mp97-rr25-mw8qCGA-mq9g-c2gm-fvxpCGA-mrwq-4x22-5xggCGA-p42q-8jq9-4gh3CGA-p7vx-4mqg-33rwCGA-phf6-h345-cq48CGA-pq4v-7vmq-4fgmCGA-pw2g-3hvx-r7mvCGA-pwq8-prwq-3299CGA-pxjm-gx28-hrcqCGA-249r-qp3g-3g99CGA-253f-4xvv-w9ppCGA-278j-2whm-f8h2CGA-2m6f-4459-vqcmCGA-2x79-mcvg-pxvxCGA-32h7-28gw-4hfjCGA-3624-vcrp-8fqcCGA-37fp-gpxf-m2gxCGA-37hf-594w-rjrvCGA-3r3f-wpm6-qvrjCGA-3vj5-r2q6-6cgfCGA-3w9r-5rv7-x7vpCGA-44gc-j438-whp7CGA-4725-v5v4-8x37CGA-4965-g5fv-wvg3CGA-4h58-vhwg-3qj9CGA-4xpf-phqm-47m8CGA-537p-gq3p-q6v2CGA-5gpj-x7ff-583vCGA-5qw3-2r37-x3jqCGA-5wcw-rfxh-7759CGA-638p-4chj-gcwvCGA-682v-w4jg-f3gxCGA-697h-3r6f-hm73CGA-6g9r-9gxc-w8pxCGA-6x97-g2c9-p2jqCGA-72q2-294v-xmhjCGA-73f3-33v5-2xf7CGA-75qv-43c2-66m8CGA-799h-h9q6-gfhhCGA-7jv6-7rxh-wwxwCGA-7m3w-32rf-mhphCGA-7p33-frwr-4wjfCGA-7qrr-h5pv-95pfCGA-7rw4-7mvx-55jhCGA-7v97-jv77-p699CGA-7wj7-h5w8-xh4rCGA-8588-5px3-h9fmCGA-87hp-c4fm-6c5qCGA-8q39-frfg-v75xCGA-8w7c-6rmw-qmcjCGA-8x47-c62c-w2w2CGA-93c6-jfq6-r4cvCGA-9fv8-3wfm-fvpvCGA-9rhh-7jfq-8ww7CGA-9w4w-fqfx-96wcCGA-c2p5-p364-wgm7CGA-c6gm-jv3c-99jwCGA-c6h3-pgqr-p5hpCGA-cgj2-4gp7-wq44CGA-chxh-m8cf-hm89CGA-cmgg-8rmm-75gcCGA-cq86-c54p-g83fCGA-cxh8-95hg-wjp6CGA-f259-686f-r9m2CGA-f7qp-rgx8-xpgjCGA-f7v3-7jq5-4986CGA-frcp-xqxp-9wj5CGA-fx3w-rghc-3vhvCGA-g74j-mf5f-x897CGA-g7qm-rgm8-w3x8CGA-gjmw-j65h-5g9cCGA-gpq2-9cr7-f89wCGA-h29m-qwfp-9xcrCGA-h2wg-8vxq-6w2cCGA-h74m-f499-3jcgCGA-h8w9-q8gj-h2w8CGA-hc6h-hcxw-86cwCGA-hgqm-3cjw-hqc4CGA-hp6h-w77r-pf52CGA-hw9x-899h-wg24CGA-j554-6fch-q3xgCGA-j8x8-pv6h-q98mCGA-jgpm-jcwc-r23hCGA-jjf7-fgw4-235vCGA-m339-r3q7-7387CGA-m5mx-w4f6-3495CGA-m88w-fjfj-8ghjCGA-mg2r-p82x-hjj5CGA-mmgw-m3h5-3gv7CGA-p8cw-8gqv-9wg6CGA-p97p-xw72-qg2rCGA-pjv8-8rrr-cmqmCGA-pq6r-3rj2-wq4pCGA-pr68-q7g8-wqwcCGA-pw73-55gc-rvm4CGA-q3p2-xcrc-fjjcCGA-q494-6vcf-5vj6CGA-q7jr-f3m6-c43jCGA-qfh3-7v88-jwccCGA-qh4h-qrcj-v4j5CGA-qhh2-939r-92qrCGA-qqg5-vp25-p947CGA-qr56-8g2g-f5xwCGA-qwmg-g3jq-jwp9CGA-r44q-hpqp-m99wCGA-r78x-4fwp-cqh4CGA-rcw7-h93x-3f75CGA-rpcm-53mr-chppCGA-rpjm-h7cx-8m34CGA-rv24-p42f-5g22CGA-rx6w-vwpf-2p6gCGA-rxm8-cj4x-mrh5CGA-v42w-v8r8-9xj7CGA-v4gr-chp9-c4phCGA-v7c5-c3gv-4687CGA-v7hj-wx5p-4hmjCGA-v86x-c4vg-2q3gCGA-v8mr-3pw4-2vp8CGA-vf2g-rf9x-fh5qCGA-vf35-44vq-8c46CGA-vgm8-j8rf-xfrwCGA-vp84-9qvv-g7q7CGA-vx84-jxqj-jmwhCGA-w4cv-2jhx-mp6wCGA-w5c7-g28j-pqw2CGA-w83f-3qjf-85qhCGA-w9cg-rr5p-3c36CGA-wgjj-426f-v7q6CGA-wjrg-72wq-rcpqCGA-wmff-jrmh-pvhfCGA-wpj7-qr96-cjwfCGA-wqj4-625c-frjpCGA-wqm3-j9p3-694jCGA-wv8x-4xvj-jccxCGA-ww5r-r6x7-8hq2CGA-ww7x-w6rg-vvw9CGA-x272-wjwm-wq46CGA-x35g-vvc6-97jxCGA-x48w-gf97-h3j3CGA-x6cx-78q6-jpcfCGA-x987-3qhq-gr3qCGA-x9r6-c66r-h6hmCGA-xf8h-9742-fm2pCGA-xfrp-h43v-w958CGA-xg35-w8vj-5mp8CGA-xjm3-vwxx-5853CGA-xmwh-qp6q-6vgcCGA-xqrp-3pjg-7p5gCGA-xr4w-cpm7-46pxCGA-xv84-7v6h-43gpCGA-xwg6-fx98-qpp3
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 09 Apr 2025, 22:28
Last modified:10 Apr 2025, 14:58

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.48% LOW
0% probability +0.47%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Apr 2025, 22:28
Published
Vulnerability first disclosed
10 Apr 2025, 14:58
Last Modified
Vulnerability information updated

Description

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.48%• Percentile: 41%

Techniques & Countermeasures

  • CWE-121•Stack-based Buffer Overflow

    A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

  • CWE-674•Uncontrolled Recursion

    The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Systems

  • chainguard•cert-manager-cmctl

    < 2.1.1-r11

  • chainguard•cert-manager-cmctl-fips

    < 2.1.1-r10

  • chainguard•chart-testing

    < 3.12.0-r2

  • chainguard•chart-testing-fips

    < 3.12.0-r3

  • chainguard•chartmuseum

    < 0.16.2-r18

  • chainguard•chartmuseum-fips

    < 0.16.2-r16

  • chainguard•cilium-cli

    < 0.18.3-r1

  • chainguard•cluster-api-helm-controller

    < 0.4.1-r1

  • chainguard•cluster-api-helm-controller-fips

    < 0.4.1-r1 | < 0.4.1-r2

  • chainguard•consul-k8s-1.7

    < 1.7.1-r1

  • chainguard•consul-k8s-1.7-cli

    < 1.7.1-r1

  • chainguard•consul-k8s-fips-1.4-cli

    < 1.4.10-r25

  • chainguard•eksctl

    < 0.207.0-r3

  • chainguard•flux

    < 2.5.1-r5

  • chainguard•flux-2.5

    < 2.5.1-r6

  • chainguard•flux-2.5-compat

    < 2.5.1-r6

  • chainguard•flux-fips-2.5

    < 2.5.1-r5

  • chainguard•flux-fips-2.5-compat

    < 2.5.1-r5

  • chainguard•flux-helm-controller

    < 1.2.0-r7

  • chainguard•flux-helm-controller-fips

    < 1.2.0-r5

  • chainguard•flux-helm-controller-iamguarded-compat

    < 1.2.0-r7

  • chainguard•flux-source-controller

    < 1.5.0-r42

  • chainguard•flux-source-controller-fips

    < 1.5.0-r8

  • chainguard•flux-source-controller-iamguarded-compat

    < 1.5.0-r42

  • chainguard•gem-check

    < 0.0.13-r0

  • chainguard•gosh

    < 0.0.13-r0

  • chainguard•harbor-2.11

    < 2.11.2-r8

  • chainguard•harbor-2.11-exporter

    < 2.11.2-r8

  • chainguard•harbor-2.11-jobservice

    < 2.11.2-r8

  • chainguard•harbor-2.11-photon-registry

    < 2.11.2-r8

  • chainguard•harbor-2.11-portal

    < 2.11.2-r8

  • chainguard•harbor-2.11-portal-nginx-config

    < 2.11.2-r8

  • chainguard•harbor-2.11-redis-compat

    < 2.11.2-r8

  • chainguard•harbor-2.11-registryctl

    < 2.11.2-r8

  • chainguard•harbor-2.12

    < 2.12.2-r10

  • chainguard•harbor-2.12-exporter

    < 2.12.2-r10

  • chainguard•harbor-2.12-jobservice

    < 2.12.2-r10

  • chainguard•harbor-2.12-photon-registry

    < 2.12.2-r10

  • chainguard•harbor-2.12-portal

    < 2.12.2-r10

  • chainguard•harbor-2.12-portal-nginx-config

    < 2.12.2-r10

  • chainguard•harbor-2.12-redis-compat

    < 2.12.2-r10

  • chainguard•harbor-2.12-registryctl

    < 2.12.2-r10

  • chainguard•harbor-2.9-portal-nginx-config

    all | < 2.9.5-r17

  • chainguard•harbor-fips-2.11

    < 2.11.2-r12

  • chainguard•harbor-fips-2.11-db

    < 2.11.2-r12

  • chainguard•harbor-fips-2.11-exporter

    < 2.11.2-r12

  • chainguard•harbor-fips-2.11-jobservice

    < 2.11.2-r12

  • chainguard•harbor-fips-2.11-photon-registry

    < 2.11.2-r12

  • chainguard•harbor-fips-2.11-portal

    < 2.11.2-r12

  • chainguard•harbor-fips-2.11-redis-compat

    < 2.11.2-r12

Showing first 50 affected entries in server-rendered view.

References (5)