TI-2022-16473 Aliases CVE-2022-36049 GHSA-p2g7-xwvr-rrw3

Flux2 Helm Controller denial of service

LOW 37CWE-400Published 2022-09-07 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01542 75th percentileScored 2026-11-07

Fix Fixed flux2 (fluxcd): 0.23.0, 0.32.0github.com/fluxcd/helm-controller (Go): 0.23.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fluxcd	flux2	0.0.4 to before 0.23.0; 0.0.17 to before 0.32.0	0.23.0, 0.32.0	Patch available	CNA
—	github.com/fluxcd/helm-controller (Go)	0.0.4 to before 0.23.0	0.23.0	Patch available	GHSA-p2g7-xwvr-rrw3
—	github.com/fluxcd/flux2 (Go)	0.0.17 to before 0.32.0	0.32.0	Patch available	GHSA-p2g7-xwvr-rrw3

flux2 Vendorfluxcd Affected 0.0.4 to before 0.23.0; 0.0.17 to before 0.32.0 Fixed in 0.23.0, 0.32.0 Patch available CNA
github.com/fluxcd/helm-controller (Go) Vendor— Affected 0.0.4 to before 0.23.0 Fixed in 0.23.0 Patch available GHSA-p2g7-xwvr-rrw3
github.com/fluxcd/flux2 (Go) Vendor— Affected 0.0.17 to before 0.32.0 Fixed in 0.32.0 Patch available GHSA-p2g7-xwvr-rrw3

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:helm:helm::::::::	3.0.0 to before 3.9.4	Vulnerable	helm
cpe:2.3:a:fluxcd:flux2::::::::	0.0.17 to before 0.32.0	Vulnerable	fluxcd
cpe:2.3:a:fluxcd:helm-controller::::::::	0.0.4 to before 0.23.0	Vulnerable	fluxcd

cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.9.4 Vulnerable ·helm
cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:* Versions 0.0.17 to before 0.32.0 Vulnerable ·fluxcd
cpe:2.3:a:fluxcd:helm-controller:*:*:*:*:*:*:*:* Versions 0.0.4 to before 0.23.0 Vulnerable ·fluxcd

Remediation

Fix · CNA flux2 (fluxcd) Fixed in 0.23.0, 0.32.0
Fix · GHSA-p2g7-xwvr-rrw3 github.com/fluxcd/helm-controller (Go) Fixed in 0.23.0 Advisory →
Fix · GHSA-p2g7-xwvr-rrw3 github.com/fluxcd/flux2 (Go) Fixed in 0.32.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36049
2026-10-03 Alias added: GHSA-p2g7-xwvr-rrw3

References

Advisory 5

Other 1

https://github.com/fluxcd/flux2

TI-2022-08687 Improper path handling in kustomization files allows path traversal CVSS 3.1CRITICAL 9.9
TI-2022-08630 Improper kubeconfig validation allows arbitrary code execution CVSS 3.1CRITICAL 9.9
TI-2022-16460 Flux CLI Workload Injection CVSS 3.1HIGH 7.8
TI-2022-08688 Improper path handling in Kustomization files allows for denial of service CVSS 3.1HIGH 7.7
TI-2022-18648 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences