CVE-2025-32386
MediumAdvisory
Published 9 Apr 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.004
- 38th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 154
- of 17,781 indexed, latest versions
- Container images
- 157
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
Carried by container images the latest versions of 154 of 17,781 indexed charts deploy, on 157 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| helm.sh/ | v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+66 more | 3.17.3 | 157 |
| helmdeb | 3.18.1-1 | no fix listed | 1 |
- OSV records
- GHSA-4hfp-h4cw-hj8pUBUNTU-CVE-2025-32386
- Also known as
- BIT-helm-2025-32386, GO-2025-3601
Charts affected
154 by stars
Container images carrying it
157 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| goharbor/ | 8d5339ff2d74 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | b9522c3f5056 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | dc5b882a7db4 | helm.sh/ | 3.17.3 | 1 |
| hashicorp/ | 97d521a27498 | helm.sh/ | 3.17.3 | 1 |
| inseefrlab/ | 31f04ca7436b | helm.sh/ | 3.17.3 | 1 |
| istio/ | 655eefa11c84 | helm.sh/ | 3.17.3 | 1 |
| istio/ | 6cfce8a071b9 | helm.sh/ | 3.17.3 | 1 |
| istio/ | 70f9d1fe5fff | helm.sh/ | 3.17.3 | 1 |
| istio/ | ac0284d75ec9 | helm.sh/ | 3.17.3 | 1 |
| istio/ | ce9d87606701 | helm.sh/ | 3.17.3 | 1 |
| istio/ | db08d6963975 | helm.sh/ | 3.17.3 | 1 |
| keptnsandbox/ | 6e6d323dd7ae | helm.sh/ | 3.17.3 | 1 |
| kubebb/ | 2b9e7f451d6b | helm.sh/ | 3.17.3 | 1 |
| kubebb/ | e366c34a9b8d | helm.sh/ | 3.17.3 | 1 |
| kubebb/ | 163ebbfc7a82 | helm.sh/ | 3.17.3 | 1 |
| kubeoperator/ | be8f0d624640 | helm.sh/ | 3.17.3 | 1 |
| kubesphere/ | 29681958f220 | helm.sh/ | 3.17.3 | 1 |
| kubesphere/ | 49b445b1b732 | helm.sh/ | 3.17.3 | 1 |
| layer5/ | 77d59943b3d6 | helm.sh/ | 3.17.3 | 1 |
| layer5/ | 25a4cc38abcd | helm.sh/ | 3.17.3 | 1 |
| layer5/ | fde47c141ec6 | helm.sh/ | 3.17.3 | 1 |
| layer5/ | 9d25f029a8a2 | helm.sh/ | 3.17.3 | 1 |
| layer5/ | b99c73bac1f5 | helm.sh/ | 3.17.3 | 1 |
| layer5/ | b3864dfd47ad | helm.sh/ | 3.17.3 | 1 |
| layer5/ | ebd6a8faf21f | helm.sh/ | 3.17.3 | 1 |
| layer5/ | ec898e5786c6 | helm.sh/ | 3.17.3 | 1 |
| layer5/ | 797fa7a03570 | helm.sh/ | 3.17.3 | 1 |
| logiqai/ | 65b996bc7bdc | helm.sh/ | 3.17.3 | 1 |
| mavrick1/ | 45ca0429a1d4 | helm.sh/ | 3.17.3 | 1 |
| murtazashah46/ | 4d11726cf803 | helm.sh/ | 3.17.3 | 1 |
| newrelic/ | 1a448492b55a | helm.sh/ | 3.17.3 | 1 |
| phntom/ | 53883b65d9b7 | helm.sh/ | 3.17.3 | 1 |
| phntom/ | 9242b4df9e65 | helm.sh/ | 3.17.3 | 1 |
| pnnlmiscscripts/ | 155131891741 | helm.sh/ | 3.17.3 | 1 |
| pnnlmiscscripts/ | 8af4b7551d40 | helm.sh/ | 3.17.3 | 1 |
| portainer/ | 3e61aaee1341 | helm.sh/ | 3.17.3 | 1 |
| replicated/ | 8751b4963250 | helm.sh/ | 3.17.3 | 1 |
| sirrend/ | 699e79e3d4e2 | helm.sh/ | 3.17.3 | 1 |
| sstarcher/ | 11769d01ba35 | helm.sh/ | 3.17.3 | 1 |
| veecode/ | c69fd286b489 | helm.sh/ | 3.17.3 | 1 |
| gcr.io/ | 8d4576f7b98f | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | d6c2532ea386 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | a608b798fda5 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | 68e17a8aaa40 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | 9ab9a675c405 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | 2cef2a3f97da | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | e02a8bd9e2c3 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | 3ee1b62aa111 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | a058034ca006 | helm.sh/ | 3.17.3 | 1 |
| ghcr.io/ | 700bb42ac21d | helm.sh/ | 3.17.3 | 1 |