GitHub Advisoryadvisory · Go

GHSA-5xqw-8hwv-wg92 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

MEDIUM Published 2025-04-10 Modified 2025-04-10 Official page ↗
Aliases
CVE-2025-32387
Ecosystem
Go
Packages
helm.sh/helm/v3
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-121, CWE-674
Reviewed
2025-04-10

Affected packages

• Go helm.sh/helm/v3: < 3.17.3 → fixed in 3.17.3

Description

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow. Impact A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. Patches This issue has been resolved in Helm v3.17.3. Workarounds Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB. For more information Helm's security policy is spelled out in detail in our SECURITY document. Credits Disclosed by Jakub Ciolek at AlphaSense.

Related

Alias · CVE (1)

  • CVE-2025-32387 Helm is a package manager for Charts for Kubernetes. vulnerability

Weakness · CWE (2)

  • CWE-121 Stack-based Buffer Overflow weakness
  • CWE-674 Uncontrolled Recursion weakness

References