CVE-2025-55198: helm Use of Uninitialized Resource

CVSS: 6.5v3.1MediumAnalyzed

AliasesCGA-253r-xrc3-5389CGA-2782-5p5q-gx3rCGA-2c4w-cgwj-29w3+519 more

Published 13-08-2025Last modified 14-08-2025

Vulnerability summary

CVE-2025-55198 is a medium (CVSS 6.5) Use of Uninitialized Resource vulnerability in helm. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.2% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.33%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 51

OPENSUSE-SU-2025:15469-1 OPENSUSE-SU-2026:21483-1 CGA-27XR-R4MC-F6J8 CGA-2G5R-XF83-FWP8 CGA-2QQC-8XX3-FX6P CGA-2VVP-PHXJ-5V4Q+45 more

Timeline

13-08-2025
PublishedVulnerability first disclosed.
14-08-2025
Last modifiedVulnerability information updated.

Description

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.5

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.

Affected systems

Chainguard200 products

cerbos< 0.46.0-r2
cerbos-compat< 0.46.0-r2
cerbos-fips< 0.46.0-r3
cerbosctl< 0.46.0-r2
cerbosctl-compat< 0.46.0-r2

cerbosctl-fips< 0.46.0-r3
cert-manager-cmctl< 2.3.0-r4
cert-manager-cmctl-fips< 2.3.0-r3
chart-testing< 3.13.0-r6
chart-testing-fips< 3.13.0-r6
chartmuseum< 0.16.3-r6
chartmuseum-fips< 0.16.3-r5
cilium-cli< 0.18.6-r2
cluster-api-helm-controller< 0.3.2-r5
cluster-api-helm-controller-compat< 0.3.2-r5
cluster-api-helm-controller-fips< 0.3.2-r5
cluster-api-helm-controller-fips-compat< 0.3.2-r5
consul-k8s-1.1< 1.1.18-r17
consul-k8s-1.1-cli< 1.1.18-r17
consul-k8s-1.3< 1.3.9-r18
consul-k8s-1.3-cli< 1.3.9-r18
consul-k8s-1.4< 1.4.10-r5
consul-k8s-1.4-cli< 1.4.10-r5
consul-k8s-1.5< 1.5.9-r4
consul-k8s-1.5-cli< 1.5.9-r4
consul-k8s-1.6< 1.6.7-r2
consul-k8s-1.6-cli< 1.6.7-r2
consul-k8s-1.7< 1.7.4-r0
consul-k8s-1.7-cli< 1.7.4-r0
consul-k8s-fips-1.1< 1.1.18-r16
consul-k8s-fips-1.1-cli< 1.1.18-r16
consul-k8s-fips-1.3< 1.3.9-r17
consul-k8s-fips-1.3-cli< 1.3.9-r17
consul-k8s-fips-1.4< 1.4.10-r5
consul-k8s-fips-1.4-cli< 1.4.10-r5
consul-k8s-fips-1.5< 1.5.9-r5
consul-k8s-fips-1.5-cli< 1.5.9-r5
consul-k8s-fips-1.6< 1.6.7-r3
consul-k8s-fips-1.6-cli< 1.6.7-r3
consul-k8s-fips-1.7< 1.7.3-r2
consul-k8s-fips-1.7-cli< 1.7.3-r2
eksctl< 0.214.0-r0
envoy-gateway< 1.5.0-r1
envoy-gateway-compat< 1.5.0-r1
envoy-gateway-egctl< 1.5.0-r1
envoy-gateway-fips< 1.5.0-r1
envoy-gateway-fips-egctl< 1.5.0-r1
flux< 2.6.4-r4
flux-2.5< 2.5.1-r13
flux-2.5-compat< 2.5.1-r13
flux-2.6< 2.6.4-r4
flux-2.6-compat< 2.6.4-r4
flux-fips-2.5< 2.5.1-r11
flux-fips-2.5-compat< 2.5.1-r11
flux-fips-2.6< 2.6.4-r3
flux-fips-2.6-compat< 2.6.4-r3
flux-helm-controller< 1.3.0-r7
flux-helm-controller-fips< 1.3.0-r7
flux-helm-controller-iamguarded-compat< 1.3.0-r7
flux-source-controller< 1.6.2-r4
flux-source-controller-fips< 1.6.2-r6
flux-source-controller-iamguarded-compat< 1.6.2-r4
gem-checkAll versions (No fix recorded)
goshAll versions (No fix recorded)
harbor-2.11< 2.11.2-r18
harbor-2.11-exporter< 2.11.2-r18
harbor-2.11-jobservice< 2.11.2-r18
harbor-2.11-photon-registry< 2.11.2-r18
harbor-2.11-portal< 2.11.2-r18
harbor-2.11-portal-nginx-config< 2.11.2-r18
harbor-2.11-redis-compat< 2.11.2-r18
harbor-2.11-registryctl< 2.11.2-r18
harbor-2.12< 2.12.4-r11
harbor-2.12-exporter< 2.12.4-r11
harbor-2.12-jobservice< 2.12.4-r11
harbor-2.12-photon-registry< 2.12.4-r11
harbor-2.12-portal< 2.12.4-r11
harbor-2.12-portal-nginx-config< 2.12.4-r11
harbor-2.12-redis-compat< 2.12.4-r11
harbor-2.12-registryctl< 2.12.4-r11
harbor-2.13< 2.13.2-r6
harbor-2.13-exporter< 2.13.2-r6
harbor-2.13-jobservice< 2.13.2-r6
harbor-2.13-photon-registry< 2.13.2-r6
harbor-2.13-portal< 2.13.2-r6
harbor-2.13-portal-nginx-config< 2.13.2-r6
harbor-2.13-redis-compat< 2.13.2-r6
harbor-2.13-registryctl< 2.13.2-r6
harbor-fips-2.11< 2.11.2-r23
harbor-fips-2.11-db< 2.11.2-r23
harbor-fips-2.11-exporter< 2.11.2-r23
harbor-fips-2.11-jobservice< 2.11.2-r23
harbor-fips-2.11-photon-registry< 2.11.2-r23
harbor-fips-2.11-portal< 2.11.2-r23
harbor-fips-2.11-redis-compat< 2.11.2-r23
harbor-fips-2.11-registryctl< 2.11.2-r23
harbor-fips-2.12< 2.12.4-r10
harbor-fips-2.12-db< 2.12.4-r10
harbor-fips-2.12-exporter< 2.12.4-r10
harbor-fips-2.12-jobservice< 2.12.4-r10
harbor-fips-2.12-photon-registry< 2.12.4-r10
harbor-fips-2.12-portal< 2.12.4-r10
harbor-fips-2.12-redis-compat< 2.12.4-r10
harbor-fips-2.12-registryctl< 2.12.4-r10
harbor-fips-2.13< 2.13.2-r5
harbor-fips-2.13-db< 2.13.2-r5
harbor-fips-2.13-exporter< 2.13.2-r5
harbor-fips-2.13-jobservice< 2.13.2-r5
harbor-fips-2.13-photon-registry< 2.13.2-r5
harbor-fips-2.13-portal< 2.13.2-r5
harbor-fips-2.13-redis-compat< 2.13.2-r5
harbor-fips-2.13-registryctl< 2.13.2-r5
header-checkAll versions (No fix recorded)
headlamp< 0.34.0-r1
headlamp-compat< 0.34.0-r1
headlamp-fips< 0.34.0-r1
headlamp-fips-compat< 0.34.0-r1
helm-docs< 1.14.2-r13
helm-mapkubeapis< 0.6.1-r3
helm-operator< 1.41.1-r3
helm-operator-compat< 1.41.1-r3
helm-operator-fips< 1.41.1-r3
helm-operator-fips-compat< 1.41.1-r3
helm-push< 0.10.4-r33
helm-set-status< 0.3.0-r3
help-checkAll versions (No fix recorded)
istio-1.26< 1.26.3-r2
istio-1.27< 1.27.0-r2
istio-cni-1.26< 1.26.3-r2
istio-cni-1.26-compat< 1.26.3-r2
istio-cni-1.27< 1.27.0-r2
istio-cni-1.27-compat< 1.27.0-r2
istio-install-cni-1.26< 1.26.3-r2
istio-install-cni-1.26-compat< 1.26.3-r2
istio-install-cni-1.27< 1.27.0-r2
istio-install-cni-1.27-compat< 1.27.0-r2
istio-pilot-agent-1.25< 1.25.4-r2
istio-pilot-agent-1.25-compat< 1.25.4-r2
istio-pilot-agent-1.26< 1.26.3-r2
istio-pilot-agent-1.26-compat< 1.26.3-r2
istio-pilot-agent-1.27< 1.27.0-r2
istio-pilot-agent-1.27-compat< 1.27.0-r2
istio-pilot-discovery-1.26< 1.26.3-r2
istio-pilot-discovery-1.26-compat< 1.26.3-r2
istio-pilot-discovery-1.27< 1.27.0-r2
istio-pilot-discovery-1.27-compat< 1.27.0-r2
istioctl-1.26< 1.26.3-r2
istioctl-1.27< 1.27.0-r2
istioctl-bash-completion-1.26< 1.26.3-r2
istioctl-bash-completion-1.27< 1.27.0-r2
istioctl-zsh-completion-1.26< 1.26.3-r2
istioctl-zsh-completion-1.27< 1.27.0-r2
k8sgptAll versions (No fix recorded) | < 0.4.36-r1
k8ssandra-client< 0.8.2-r1
k8ssandra-client-compat< 0.8.2-r1
k8ssandra-client-fips< 0.8.2-r1
k9s< 0.50.9-r5
k9s-fips< 0.50.9-r5
kargo< 1.7.2-r1
kargo-oci-compat< 1.7.2-r1
kots< 1.126.0-r0
kots-compat< 1.126.0-r0
kots-symlink-compat< 1.126.0-r0
kubescape< 3.0.37-r2
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kuma-2.10< 2.10.5-r2
kuma-2.11< 2.11.4-r2
kuma-2.9< 2.9.8-r2
kuma-cni-2.10< 2.10.5-r2
kuma-cni-2.11< 2.11.4-r2
kuma-cni-2.9< 2.9.8-r2
kuma-cni-compat-2.10< 2.10.5-r2
kuma-cni-compat-2.11< 2.11.4-r2
kuma-cni-compat-2.9< 2.9.8-r2
kuma-cp-2.10< 2.10.5-r2
kuma-cp-2.11< 2.11.4-r2
kuma-cp-2.9< 2.9.8-r2
kuma-dp-2.10< 2.10.5-r2
kuma-dp-2.11< 2.11.4-r2
kuma-dp-2.9< 2.9.8-r2
kuma-install-cni-2.10< 2.10.5-r2
kuma-install-cni-2.11< 2.11.4-r2
kuma-install-cni-2.9< 2.9.8-r2
kumactl-2.10< 2.10.5-r2
kumactl-2.11< 2.11.4-r2
kumactl-2.7All versions (No fix recorded)
kumactl-2.9< 2.9.8-r2
ldd-checkAll versions (No fix recorded)
linkerd2< 25.8.3-r0
linkerd2-cli< 25.8.3-r0
linkerd2-controller< 25.8.3-r0
linkerd2-controller-compat< 25.8.3-r0
linkerd2-debug< 25.8.3-r0
linkerd2-fips< 25.8.3-r0
linkerd2-fips-cli< 25.8.3-r0
linkerd2-fips-controller< 25.8.3-r0
linkerd2-fips-controller-compat< 25.8.3-r0

Show all 200

1 vendor · 200 products · Showing 200 of 345. Use Open JSON for the complete list.

References

5 links

github.com/helm/helm/security/advisories/GHSA-f9f8-9pmf-xv68X Refsource CONFIRMAdvisoryWEBThird Party Advisory
github.com/helm/helm/commit/ec5f59e2db56533d042a124f5bae54dd87b558e6X Refsource MISCFIXWEBPatch
github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55198.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-55198AdvisoryOval
github.com/helm/helmPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities