CVE-2025-55199: helm

CVSS: 6.5v3.1MediumAnalyzed

AliasesCGA-224v-q762-52pjCGA-24mg-jjwp-37hjCGA-25g6-r2gh-v5x6+521 more

Published 13-08-2025Last modified 14-08-2025

Vulnerability summary

CVE-2025-55199 is a medium (CVSS 6.5) vulnerability in helm. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.3% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.33%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 56

OPENSUSE-SU-2025:15469-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:1483-1 SUSE-SU-2026:21434-1 SUSE-SU-2026:21461-1 CGA-24HX-3RRJ-WPMV+50 more

Timeline

13-08-2025
PublishedVulnerability first disclosed.
14-08-2025
Last modifiedVulnerability information updated.

Description

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.5

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard200 products

cerbos< 0.46.0-r2
cerbos-compat< 0.46.0-r2
cerbos-fips< 0.46.0-r3
cerbosctl< 0.46.0-r2
cerbosctl-compat< 0.46.0-r2

cerbosctl-fips< 0.46.0-r3
cert-manager-cmctl< 2.3.0-r4
cert-manager-cmctl-fips< 2.3.0-r3
chart-testing< 3.13.0-r6
chart-testing-fips< 3.13.0-r6
chartmuseum< 0.16.3-r6
chartmuseum-fips< 0.16.3-r5
cilium-cli< 0.18.6-r2
cluster-api-helm-controller< 0.3.2-r5
cluster-api-helm-controller-compat< 0.3.2-r5
cluster-api-helm-controller-fips< 0.3.2-r5
cluster-api-helm-controller-fips-compat< 0.3.2-r5
consul-k8s-1.1< 1.1.18-r17
consul-k8s-1.1-cli< 1.1.18-r17
consul-k8s-1.3< 1.3.9-r18
consul-k8s-1.3-cli< 1.3.9-r18
consul-k8s-1.4< 1.4.10-r5
consul-k8s-1.4-cli< 1.4.10-r5
consul-k8s-1.5< 1.5.9-r4
consul-k8s-1.5-cli< 1.5.9-r4
consul-k8s-1.6< 1.6.7-r2
consul-k8s-1.6-cli< 1.6.7-r2
consul-k8s-1.7< 1.7.4-r0
consul-k8s-1.7-cli< 1.7.4-r0
consul-k8s-fips-1.1< 1.1.18-r16
consul-k8s-fips-1.1-cli< 1.1.18-r16
consul-k8s-fips-1.3< 1.3.9-r17
consul-k8s-fips-1.3-cli< 1.3.9-r17
consul-k8s-fips-1.4< 1.4.10-r5
consul-k8s-fips-1.4-cli< 1.4.10-r5
consul-k8s-fips-1.5< 1.5.9-r5
consul-k8s-fips-1.5-cli< 1.5.9-r5
consul-k8s-fips-1.6< 1.6.7-r3
consul-k8s-fips-1.6-cli< 1.6.7-r3
consul-k8s-fips-1.7< 1.7.3-r2
consul-k8s-fips-1.7-cli< 1.7.3-r2
eksctl< 0.214.0-r0
envoy-gateway< 1.5.0-r1
envoy-gateway-compat< 1.5.0-r1
envoy-gateway-egctl< 1.5.0-r1
envoy-gateway-fips< 1.5.0-r1
envoy-gateway-fips-egctl< 1.5.0-r1
flux< 2.6.4-r4
flux-2.5< 2.5.1-r13
flux-2.5-compat< 2.5.1-r13
flux-2.6< 2.6.4-r4
flux-2.6-compat< 2.6.4-r4
flux-fips-2.5< 2.5.1-r11
flux-fips-2.5-compat< 2.5.1-r11
flux-fips-2.6< 2.6.4-r3
flux-fips-2.6-compat< 2.6.4-r3
flux-helm-controller< 1.3.0-r7
flux-helm-controller-fips< 1.3.0-r7
flux-helm-controller-iamguarded-compat< 1.3.0-r7
flux-source-controller< 1.6.2-r4
flux-source-controller-fips< 1.6.2-r6
flux-source-controller-iamguarded-compat< 1.6.2-r4
gem-check< 0.0.25-r0
gosh< 0.0.25-r0
harbor-2.11< 2.11.2-r18
harbor-2.11-exporter< 2.11.2-r18
harbor-2.11-jobservice< 2.11.2-r18
harbor-2.11-photon-registry< 2.11.2-r18
harbor-2.11-portal< 2.11.2-r18
harbor-2.11-portal-nginx-config< 2.11.2-r18
harbor-2.11-redis-compat< 2.11.2-r18
harbor-2.11-registryctl< 2.11.2-r18
harbor-2.12< 2.12.4-r11
harbor-2.12-exporter< 2.12.4-r11
harbor-2.12-jobservice< 2.12.4-r11
harbor-2.12-photon-registry< 2.12.4-r11
harbor-2.12-portal< 2.12.4-r11
harbor-2.12-portal-nginx-config< 2.12.4-r11
harbor-2.12-redis-compat< 2.12.4-r11
harbor-2.12-registryctl< 2.12.4-r11
harbor-2.13< 2.13.2-r6
harbor-2.13-exporter< 2.13.2-r6
harbor-2.13-jobservice< 2.13.2-r6
harbor-2.13-photon-registry< 2.13.2-r6
harbor-2.13-portal< 2.13.2-r6
harbor-2.13-portal-nginx-config< 2.13.2-r6
harbor-2.13-redis-compat< 2.13.2-r6
harbor-2.13-registryctl< 2.13.2-r6
harbor-fips-2.11< 2.11.2-r23
harbor-fips-2.11-db< 2.11.2-r23
harbor-fips-2.11-exporter< 2.11.2-r23
harbor-fips-2.11-jobservice< 2.11.2-r23
harbor-fips-2.11-photon-registry< 2.11.2-r23
harbor-fips-2.11-portal< 2.11.2-r23
harbor-fips-2.11-redis-compat< 2.11.2-r23
harbor-fips-2.11-registryctl< 2.11.2-r23
harbor-fips-2.12< 2.12.4-r10
harbor-fips-2.12-db< 2.12.4-r10
harbor-fips-2.12-exporter< 2.12.4-r10
harbor-fips-2.12-jobservice< 2.12.4-r10
harbor-fips-2.12-photon-registry< 2.12.4-r10
harbor-fips-2.12-portal< 2.12.4-r10
harbor-fips-2.12-redis-compat< 2.12.4-r10
harbor-fips-2.12-registryctl< 2.12.4-r10
harbor-fips-2.13< 2.13.2-r5
harbor-fips-2.13-db< 2.13.2-r5
harbor-fips-2.13-exporter< 2.13.2-r5
harbor-fips-2.13-jobservice< 2.13.2-r5
harbor-fips-2.13-photon-registry< 2.13.2-r5
harbor-fips-2.13-portal< 2.13.2-r5
harbor-fips-2.13-redis-compat< 2.13.2-r5
harbor-fips-2.13-registryctl< 2.13.2-r5
header-check< 0.0.25-r0
headlamp< 0.34.0-r1
headlamp-compat< 0.34.0-r1
headlamp-fips< 0.34.0-r1
headlamp-fips-compat< 0.34.0-r1
helm-docs< 1.14.2-r13
helm-mapkubeapis< 0.6.1-r3
helm-operator< 1.41.1-r3
helm-operator-compat< 1.41.1-r3
helm-operator-fips< 1.41.1-r3
helm-operator-fips-compat< 1.41.1-r3
helm-push< 0.10.4-r33
helm-set-status< 0.3.0-r3
help-check< 0.0.25-r0
istio-1.26< 1.26.3-r2
istio-1.27< 1.27.0-r2
istio-cni-1.26< 1.26.3-r2
istio-cni-1.26-compat< 1.26.3-r2
istio-cni-1.27< 1.27.0-r2
istio-cni-1.27-compat< 1.27.0-r2
istio-install-cni-1.26< 1.26.3-r2
istio-install-cni-1.26-compat< 1.26.3-r2
istio-install-cni-1.27< 1.27.0-r2
istio-install-cni-1.27-compat< 1.27.0-r2
istio-pilot-agent-1.25< 1.25.4-r2
istio-pilot-agent-1.25-compat< 1.25.4-r2
istio-pilot-agent-1.26< 1.26.3-r2
istio-pilot-agent-1.26-compat< 1.26.3-r2
istio-pilot-agent-1.27< 1.27.0-r2
istio-pilot-agent-1.27-compat< 1.27.0-r2
istio-pilot-discovery-1.26< 1.26.3-r2
istio-pilot-discovery-1.26-compat< 1.26.3-r2
istio-pilot-discovery-1.27< 1.27.0-r2
istio-pilot-discovery-1.27-compat< 1.27.0-r2
istioctl-1.26< 1.26.3-r2
istioctl-1.27< 1.27.0-r2
istioctl-bash-completion-1.26< 1.26.3-r2
istioctl-bash-completion-1.27< 1.27.0-r2
istioctl-zsh-completion-1.26< 1.26.3-r2
istioctl-zsh-completion-1.27< 1.27.0-r2
k8sgptAll versions (No fix recorded) | < 0.4.38-r3 | < 0.4.36-r1
k8ssandra-client< 0.8.2-r1
k8ssandra-client-compat< 0.8.2-r1
k8ssandra-client-fips< 0.8.2-r1
k9s< 0.50.9-r5
k9s-fips< 0.50.9-r5
kargo< 1.7.2-r1
kargo-oci-compat< 1.7.2-r1
kots< 1.126.0-r0
kots-compat< 1.126.0-r0
kots-symlink-compat< 1.126.0-r0
kubescape< 3.0.37-r2
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kuma-2.10< 2.10.5-r2
kuma-2.11< 2.11.4-r2
kuma-2.9< 2.9.8-r2
kuma-cni-2.10< 2.10.5-r2
kuma-cni-2.11< 2.11.4-r2
kuma-cni-2.9< 2.9.8-r2
kuma-cni-compat-2.10< 2.10.5-r2
kuma-cni-compat-2.11< 2.11.4-r2
kuma-cni-compat-2.9< 2.9.8-r2
kuma-cp-2.10< 2.10.5-r2
kuma-cp-2.11< 2.11.4-r2
kuma-cp-2.9< 2.9.8-r2
kuma-dp-2.10< 2.10.5-r2
kuma-dp-2.11< 2.11.4-r2
kuma-dp-2.9< 2.9.8-r2
kuma-install-cni-2.10< 2.10.5-r2
kuma-install-cni-2.11< 2.11.4-r2
kuma-install-cni-2.9< 2.9.8-r2
kumactl-2.10< 2.10.5-r2
kumactl-2.11< 2.11.4-r2
kumactl-2.7All versions (No fix recorded)
kumactl-2.9< 2.9.8-r2
ldd-check< 0.0.25-r0
linkerd2< 25.8.3-r0
linkerd2-cli< 25.8.3-r0
linkerd2-controller< 25.8.3-r0
linkerd2-controller-compat< 25.8.3-r0
linkerd2-debug< 25.8.3-r0
linkerd2-fips< 25.8.3-r0
linkerd2-fips-cli< 25.8.3-r0
linkerd2-fips-controller< 25.8.3-r0
linkerd2-fips-controller-compat< 25.8.3-r0

Show all 200

1 vendor · 200 products · Showing 200 of 347. Use Open JSON for the complete list.

References

6 links

github.com/helm/helm/security/advisories/GHSA-9h84-qmv7-982pX Refsource CONFIRMAdvisoryWEBThird Party Advisory
github.com/helm/helm/commit/b78692c18f0fb38fe5ba4571a674de067a4c53a5X Refsource MISCFIXWEBPatch
github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55199.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-55199Advisory
github.com/helm/helmPACKAGE
www.suse.com/security/cve/CVE-2025-55199WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities