Helm May Panic Due To Incorrect YAML Content
Priority LOW 29CWE-908Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 15 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-908 and the CVSS impact.
Summary
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Fix Partial helm (helm): 3.18.5helm.sh/helm/v3 (Go): 3.18.5Red Hat: 2 advisoriesRed Hat: 2 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| helm | helm | before 3.18.5 | 3.18.5 | Patch available | CNA |
| — | helm.sh/helm/v3 (Go) | before 3.18.5 | 3.18.5 | Patch available | GHSA-f9f8-9pmf-xv68 |
- helm Vendorhelm Affected before 3.18.5 Fixed in 3.18.5 Patch available CNA
- helm.sh/helm/v3 (Go) Vendor— Affected before 3.18.5 Fixed in 3.18.5 Patch available GHSA-f9f8-9pmf-xv68
Remediation
- Fix · CNA helm (helm) Fixed in 3.18.5
- Fix · GHSA-f9f8-9pmf-xv68 helm.sh/helm/v3 (Go) Fixed in 3.18.5 Advisory →
Red Hat 2 advisories
- RHSA-2026:2129 Released 2026-02-10 · Red Hat rating ImportantOpenShift Container Platform 4.21.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-ironic-rhel9 +2
- RHSA-2025:22257 Released 2025-12-02 · Red Hat rating ModerateOpenShift Container Platform 4.20.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-console-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Deployment Validation Operator | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Build of Kueue | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Application Pipeline | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2025:22257 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:2129 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55198
- 2026-10-03 Alias added: GHSA-f9f8-9pmf-xv68
References
More Helm vulnerabilities
- TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
- TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
- TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
- TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
- TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
- TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-55198 · CVE Program
- CVE-2025-55198 · NVD
- FIRST EPSS
- GHSA-f9f8-9pmf-xv68 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-55198 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences