TI-2022-07583 Aliases CVE-2022-23524 GHSA-6rx9-889q-vv2r

Helm vulnerable to Denial of service through string value parsing

MEDIUM 40CWE-400Published 2022-12-15 · Updated 2025-04-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 2 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0081 57th percentileScored 2026-11-07

Fix Partial helm (helm): v3.10.3helm.sh/helm/v3 (Go): 3.10.3Red Hat: 1 advisoryRed Hat: 2 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
helm	helm	before v3.10.3	v3.10.3	Patch available	CNA
—	helm.sh/helm/v3 (Go)	before 3.10.3	3.10.3	Patch available	GHSA-6rx9-889q-vv2r

helm Vendorhelm Affected before v3.10.3 Fixed in v3.10.3 Patch available CNA
helm.sh/helm/v3 (Go) Vendor— Affected before 3.10.3 Fixed in 3.10.3 Patch available GHSA-6rx9-889q-vv2r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:helm:helm::::::::	3.0.0 to before 3.10.3	Vulnerable	helm

cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.10.3 Vulnerable ·helm

Remediation

Fix · CNA helm (helm) Fixed in v3.10.3
Fix · GHSA-6rx9-889q-vv2r helm.sh/helm/v3 (Go) Fixed in 3.10.3 Advisory →

Red Hat 1 advisory

RHSA-2023:1646 Released 2023-04-11 · Red Hat rating Moderate
OpenShift Container Platform 4.12.11 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/metallb-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Developer Tools and Services	Affected	No fix planned: Will not fix
OpenShift Serverless	Affected	No fix planned: Will not fix
Red Hat 3scale API Management Platform 2	Affected	No fix yet
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix planned: Will not fix
Red Hat Advanced Cluster Security 3	Affected	No fix yet
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat Openshift Container Storage 4	Affected	No fix planned: Out of support scope
cert-manager Operator for Red Hat OpenShift	Affected	No fix planned: Will not fix
RHACS 4.0 for RHEL 8	Fixed	—
Red Hat OpenShift Container Platform 4.12	Fixed	RHSA-2023:1646

Not affected: 3 products

Cryostat 2
Red Hat OpenShift Container Platform 4.12
Red Hat Openshift Data Foundation 4

Timeline

2026-10-02 Threatist record created from CVE-2022-23524
2026-10-03 Alias added: GHSA-6rx9-889q-vv2r

References

Advisory 2

Other 3

TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences