PT-2025-15872 · Helm+2 · Helm+2

Jake-Ciolek · Published 2025-04-09 · Updated 2025-09-03 · CVE-2025-32386

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.17.3

Description: A specially crafted chart archive file can cause Helm to exhaust its memory, leading to an out-of-memory termination. This occurs when the file expands to be significantly larger uncompressed than compressed, with a difference of over 800 times. The issue is related to how Helm loads chart archive files.

Recommendations: For versions prior to 3.17.3, update to Helm v3.17.3 to resolve the issue. As a temporary workaround, ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-789

Related Identifiers

AZL-59808

AZL-59838

AZL-59991

AZL-60145

BDU:2025-06057

BIT-HELM-2025-32386

CVE-2025-32386

GHSA-4HFP-H4CW-HJ8P

GO-2025-3601

OPENSUSE-SU-2025:14995-1

SUSE-SU-2025:01830-1

SUSE-SU-2025:01830-2

SUSE-SU-2025_01830-1

SUSE-SU-2025_01830-2

Affected Products

Helm

Red Os

Suse

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32386.json · Exploit
• https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7 · Patch
• https://bdu.fstec.ru/vul/2025-06057 · Security Note
• https://osv.dev/vulnerability/AZL-59991 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-32386 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-32386 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01830-2 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3601 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14995-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-32386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32386 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32386 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01830-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hfp-h4cw-hj8p · Vendor Advisory