Read the docs
TI-2022-07584 Aliases CVE-2022-23525GHSA-53c4-hhmh-vw5q

Helm vulnerable to Denial of service via NULL Pointer Dereference

Priority MEDIUM 41CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.

Summary

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00888 59th percentileScored 2026-11-07
Fix Partial helm (helm): v3.10.3helm.sh/helm/v3 (Go): 3.10.3Red Hat: 3 advisoriesRed Hat: 3 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
helmhelmbefore v3.10.3v3.10.3Patch availableCNA
—helm.sh/helm/v3 (Go)before 3.10.33.10.3Patch availableGHSA-53c4-hhmh-vw5q
  • helm Vendorhelm Affected before v3.10.3 Fixed in v3.10.3 Patch available CNA
  • helm.sh/helm/v3 (Go) Vendor— Affected before 3.10.3 Fixed in 3.10.3 Patch available GHSA-53c4-hhmh-vw5q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*3.0.0 to before 3.10.3Vulnerablehelm
  • cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.10.3 Vulnerable ·helm

Remediation

  • Fix · CNA helm (helm) Fixed in v3.10.3
  • Fix · GHSA-53c4-hhmh-vw5q helm.sh/helm/v3 (Go) Fixed in 3.10.3 Advisory →

Red Hat 3 advisories

  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:1646 Released 2023-04-11 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.11 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/metallb-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
cert-manager Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:1646
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1326
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006
Not affected: 6 products
  • Cryostat 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23525
  2. 2026-10-03 Alias added: GHSA-53c4-hhmh-vw5q

References

Patch 1

Advisory 2

Other 2

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences