Read the docs
TI-2022-07585 Aliases CVE-2022-23526GHSA-67fx-wx78-jx33

Helm contains Denial of service through schema file

Priority MEDIUM 41CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.

Summary

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The _chartutil_ package parses the schema file and loads it into structures Go can work with. Some schema files can cause array data structures to be created causing a memory violation. Applications that use the _chartutil_ package in the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate schema files that are correctly formatted before passing them to the _chartutil_ functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00888 59th percentileScored 2026-11-07
Fix Partial helm (helm): v3.10.3helm.sh/helm/v3 (Go): 3.10.3Red Hat: 3 advisoriesRed Hat: 3 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
helmhelmbefore v3.10.3v3.10.3Patch availableCNA
—helm.sh/helm/v3 (Go)before 3.10.33.10.3Patch availableGHSA-67fx-wx78-jx33
  • helm Vendorhelm Affected before v3.10.3 Fixed in v3.10.3 Patch available CNA
  • helm.sh/helm/v3 (Go) Vendor— Affected before 3.10.3 Fixed in 3.10.3 Patch available GHSA-67fx-wx78-jx33

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*3.0.0 to before 3.10.3Vulnerablehelm
  • cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.10.3 Vulnerable ·helm

Remediation

  • Fix · CNA helm (helm) Fixed in v3.10.3
  • Fix · GHSA-67fx-wx78-jx33 helm.sh/helm/v3 (Go) Fixed in 3.10.3 Advisory →

Red Hat 3 advisories

  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:1646 Released 2023-04-11 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.11 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/metallb-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
cert-manager Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:1646
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1326
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006
Not affected: 7 products
  • Cryostat 2
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23526
  2. 2026-10-03 Alias added: GHSA-67fx-wx78-jx33

References

Patch 1

Advisory 2

Other 2

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences