GitHub Advisoryadvisory · Go

GHSA-9h84-qmv7-982p Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

MEDIUM Published 2025-08-14 Modified 2025-08-14 Official page ↗
Aliases
CVE-2025-55199
Ecosystem
Go
Packages
helm.sh/helm/v3
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2025-08-14

Affected packages

• Go helm.sh/helm/v3: < 3.18.5 → fixed in 3.18.5

Description

A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. Impact A malicious chart can point `$ref` in _values.schema.json_ to a device (e.g. `/dev/*`) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination. Patches This issue has been resolved in Helm v3.18.5. Workarounds Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of `$ref` pointing to `/dev/zero`. References Helm's security policy is spelled out in detail in our SECURITY document. Credits Disclosed by Jakub Ciolek at AlphaSense.

Related

Alias · CVE (1)

  • CVE-2025-55199 Helm is a package manager for Charts for Kubernetes. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References