CVE-2025-32386
MediumAdvisory
Published 9 Apr 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.004
- 38th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 154
- of 17,781 indexed, latest versions
- Container images
- 157
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
Carried by container images the latest versions of 154 of 17,781 indexed charts deploy, on 157 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| helm.sh/ | v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+66 more | 3.17.3 | 157 |
| helmdeb | 3.18.1-1 | no fix listed | 1 |
- OSV records
- GHSA-4hfp-h4cw-hj8pUBUNTU-CVE-2025-32386
- Also known as
- BIT-helm-2025-32386, GO-2025-3601
Charts affected
154 by stars
Container images carrying it
157 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 2ad610626658 | helm.sh/ | 3.17.3 | 6 |
| keelhq/ | 73714afb4443 | helm.sh/ | 3.17.3 | 5 |
| ghcr.io/ | ab2e1fa19dd4 | helm.sh/ | 3.17.3 | 4 |
| quay.io/ | c10bde7ff9ad | helm.sh/ | 3.17.3 | 4 |
| quay.io/ | 6545dac92173 | helm.sh/ | 3.17.3 | 3 |
| quay.io/ | 98580969b333 | helm.sh/ | 3.17.3 | 3 |
| dtzar/ | 55429449408e | helm.sh/ | 3.17.3 | 2 |
| ilum/ | 624fd09528c8 | helm.sh/ | 3.17.3 | 2 |
| k0sproject/ | f04635825d51 | helm.sh/ | 3.17.3 | 2 |
| ghcr.io/ | 82d0b161161d | helm helm.sh/ | no fix listed 3.17.3 | 2 |
| quay.io/ | 5fc69e31c755 | helm.sh/ | 3.17.3 | 2 |
| quay.io/ | 74611761f052 | helm.sh/ | 3.17.3 | 2 |
| registry.gitlab.com/ | b1198ea741d1 | helm.sh/ | 3.17.3 | 2 |
| alpine/ | 105741fa6621 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | 00ac10bcb759 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | 21b24e6bf801 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | 6dbe6f391eda | helm.sh/ | 3.17.3 | 1 |
| alpine/ | 7a319b15cfc9 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | 7e1e7d5b7a96 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | 9c4976d47656 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | a41efe02a041 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | bd01dae02676 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | cd560fce90f7 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | e5c0b053fed7 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | eec354133193 | helm.sh/ | 3.17.3 | 1 |
| alpine/ | fc059f056ad0 | helm.sh/ | 3.17.3 | 1 |
| apecloud/ | 98abc64aa985 | helm.sh/ | 3.17.3 | 1 |
| aquasec/ | 6e790e233872 | helm.sh/ | 3.17.3 | 1 |
| aquasec/ | 944a04445179 | helm.sh/ | 3.17.3 | 1 |
| aquasec/ | 973d0df16189 | helm.sh/ | 3.17.3 | 1 |
| artifacthub/ | 111918d8c399 | helm.sh/ | 3.17.3 | 1 |
| artifacthub/ | 323d026e78c3 | helm.sh/ | 3.17.3 | 1 |
| artifacthub/ | 6596c8c4d955 | helm.sh/ | 3.17.3 | 1 |
| beopenit/ | d24c323fe7c3 | helm.sh/ | 3.17.3 | 1 |
| beopenit/ | b4d9f9bee224 | helm.sh/ | 3.17.3 | 1 |
| bsgrigorov/ | 45ab095f09c8 | helm.sh/ | 3.17.3 | 1 |
| datawire/ | f95ae710d75c | helm.sh/ | 3.17.3 | 1 |
| devopstales/ | 75136aa7a26e | helm.sh/ | 3.17.3 | 1 |
| devspacecloud/ | 49c397413f7b | helm.sh/ | 3.17.3 | 1 |
| dtzar/ | a1041bb0f1d1 | helm.sh/ | 3.17.3 | 1 |
| epamedp/ | 93417e18bb1a | helm.sh/ | 3.17.3 | 1 |
| flanksource/ | 689687a7cf95 | helm.sh/ | 3.17.3 | 1 |
| flomesh/ | 22f849c70b25 | helm.sh/ | 3.17.3 | 1 |
| fluxcd/ | 92b891e495d8 | helm.sh/ | 3.17.3 | 1 |
| fluxcd/ | 31a8c79a6803 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | 6ab3ca28e9e5 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | 6412d679fdc3 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | 86bf3031f4a7 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | c017dd84ee96 | helm.sh/ | 3.17.3 | 1 |
| goharbor/ | 39435daedd0c | helm.sh/ | 3.17.3 | 1 |