StackRadar

CVE-2025-32387

Medium

Advisory

Published 9 Apr 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
154
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Carried by container images the latest versions of 154 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+66 more3.17.3157
helmdeb3.18.1-1no fix listed1
OSV records
GHSA-5xqw-8hwv-wg92UBUNTU-CVE-2025-32387
Also known as
BIT-helm-2025-32387, GO-2025-3602

Charts affected

154 by stars
ChartLatestAffected imagesRadar Score
keelkeel1.2.21 of 1See more

keel keel 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/keel-hq/keel:0.22.3315e188a07c2
helm.sh/helm/v3@v3.13.1
3.17.3

Open the chart page →

809
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.8.0595c548dee6f
helm.sh/helm/v3@v3.8.1
3.17.3

Open the chart page →

16,251
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
helm.sh/helm/v3@v0.0.0-20250708195800-d80839cf37d8
3.17.3

Open the chart page →

5,240
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
helm.sh/helm/v3@v3.9.4
3.17.3

Open the chart page →

4,167
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4
3.17.3

Open the chart page →

32,902
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.17.3

Open the chart page →

23,228
helm-exportersstarcher0.5.01 of 1See more

helm-exporter sstarcher 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
sstarcher/helm-exporter:0.5.011769d01ba35
helm.sh/helm/v3@v3.0.2
3.17.3

Open the chart page →

4,154
istio-operatorwiremindVerified publisher1.18.21 of 1See more

istio-operator wiremind 1.18.2

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
istio/operator:1.18.270f9d1fe5fff
helm.sh/helm/v3@v3.11.2
3.17.3

Open the chart page →

5,630
emqx-operatoremqx-operator2.3.21 of 2See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
helm.sh/helm/v3@v3.14.3
3.17.3

Open the chart page →

4,531
steampipe-powerpipe-kubernetessteampipe-powerpipe-kubernetesVerified publisher0.13.11 of 2See more

steampipe-powerpipe-kubernetes steampipe-powerpipe-kubernetes 0.13.1

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
helm.sh/helm/v3@v3.14.2
3.17.3

Open the chart page →

5,468
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
helm.sh/helm/v3@v3.12.3
3.17.3

Open the chart page →

19,337
openshift-consoleav1o-chartsVerified publisher0.3.61 of 1See more

openshift-console av1o-charts 0.3.6

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
helm.sh/helm/v3@v3.7.1
3.17.3

Open the chart page →

9,052
cert-managerchoerodon1.8.21 of 4See more

cert-manager choerodon 1.8.2

1 of the 4 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
helm.sh/helm/v3@v3.8.1
3.17.3

Open the chart page →

7,775
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
helm.sh/helm/v3@v3.12.3
3.17.3

Open the chart page →

11,582
loftloftVerified publisher0.0.0-ci.141 of 1See more

loft loft 0.0.0-ci.14

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.17.3

Open the chart page →

3,675
helm-ai-kernelmindburn-labsOfficialVerified publisher0.8.51 of 2See more

helm-ai-kernel mindburn-labs 0.8.5

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
alpine/helmdigest-pinned105741fa6621
helm.sh/helm/v3@v0.0.0-20240814142712-fa9efb07d9d8
3.17.3

Open the chart page →

2,160
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
helm.sh/helm/v3@v0.0.0-20230614175909-f32a527a0601
3.17.3

Open the chart page →

10,315
yataiyataiVerified publisher0.4.61 of 2See more

yatai yatai 0.4.6

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai:0.4.614b482c1f1b8
helm.sh/helm/v3@v3.8.2
3.17.3

Open the chart page →

4,039
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.17.3

Open the chart page →

14,917
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
helm.sh/helm/v3@v3.12.0
3.17.3

Open the chart page →

2,898
cloudttycloudtty0.8.91 of 2See more

cloudtty cloudtty 0.8.9

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
helm.sh/helm/v3@v0.0.0-20251111020852-4f953c223ba2
3.17.3

Open the chart page →

3,951
clusternet-hubclusternet1.0.01 of 1See more

clusternet-hub clusternet 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
helm.sh/helm/v3@v3.15.2
3.17.3

Open the chart page →

1,394
clusternet-schedulerclusternet1.0.01 of 1See more

clusternet-scheduler clusternet 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
helm.sh/helm/v3@v3.15.2
3.17.3

Open the chart page →

1,394
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
helm.sh/helm/v3@v0.0.0-20250212201646-980d8ac1939e
3.17.3

Open the chart page →

10,037
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
helm.sh/helm/v3@v3.10.3
3.17.3

Open the chart page →

5,598
dockyarddockyardVerified publisher0.4.01 of 1See more

dockyard dockyard 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/kgma74/dockyard:0.4.0b40439329191
helm.sh/helm/v3@v3.16.1
3.17.3

Open the chart page →

1,542
fsmfsmOfficialVerified publisher0.2.111 of 5See more

fsm fsm 0.2.11

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
flomesh/fsm-manager:0.2.1122f849c70b25
helm.sh/helm/v3@v3.11.1
3.17.3

Open the chart page →

4,215
helm-operatorhelm-operatorVerified publisher0.0.21 of 1See more

helm-operator helm-operator 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
bsgrigorov/helm-operator:latest45ab095f09c8
helm.sh/helm/v3@v3.4.1
3.17.3

Open the chart page →

6,977
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
helm.sh/helm/v3@v0.0.0-20240710191640-3bb50bbbdd9c
3.17.3

Open the chart page →

16,514
operatoristio1.10.31 of 1See more

operator istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
istio/operator:1.10.3655eefa11c84
helm.sh/helm/v3@v3.5.3
3.17.3

Open the chart page →

10,701
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
helm.sh/helm/v3@v3.14.2
3.17.3

Open the chart page →

5,508
kdiff-snapshotskdiff-snapshotsVerified publisher0.0.551 of 1See more

kdiff-snapshots kdiff-snapshots 0.0.55

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
helm.sh/helm/v3@v3.14.2
3.17.3

Open the chart page →

5,789
ks-corekubeblocksVerified publisher1.1.32 of 5See more

ks-core kubeblocks 1.1.3

2 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
kubesphere/ks-extensions-museum:latest29681958f220
helm.sh/helm/v3@v3.12.3
3.17.3
kubesphere/kubectl:v1.27.1649b445b1b732
helm.sh/helm/v3@v3.11.1
3.17.3

Open the chart page →

4,721
kubernetes-stateless-chartkubernetes-stateless-chart1.0.31 of 1See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.17.3

Open the chart page →

3,274
mesherykubesphere-stable0.5.09 of 13See more

meshery kubesphere-stable 0.5.0

9 of the 13 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
layer5/meshery-app-mesh:stable-latest77d59943b3d6
helm.sh/helm/v3@v3.9.4
3.17.3
layer5/meshery-consul:stable-latest25a4cc38abcd
helm.sh/helm/v3@v3.13.1
3.17.3
layer5/meshery-istio:stable-latestfde47c141ec6
helm.sh/helm/v3@v3.14.1
3.17.3
layer5/meshery-kuma:stable-latest9d25f029a8a2
helm.sh/helm/v3@v3.11.1
3.17.3
layer5/meshery-linkerd:stable-latestb99c73bac1f5
helm.sh/helm/v3@v3.14.1
3.17.3
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
helm.sh/helm/v3@v3.11.1
3.17.3
layer5/meshery-nsm:stable-latestebd6a8faf21f
helm.sh/helm/v3@v3.3.1
3.17.3
layer5/meshery-osm:stable-latestec898e5786c6
helm.sh/helm/v3@v3.11.1
3.17.3
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
helm.sh/helm/v3@v3.11.1
3.17.3

Open the chart page →

24,690
kubeservice-cosign-webhookkubservice-chartsVerified publisher1.1.11 of 5See more

kubeservice-cosign-webhook kubservice-charts 1.1.1

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
helm.sh/helm/v3@v3.12.3
3.17.3

Open the chart page →

7,087
kubeservice-custom-limitrangekubservice-chartsVerified publisher1.3.01 of 5See more

kubeservice-custom-limitrange kubservice-charts 1.3.0

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
helm.sh/helm/v3@v3.12.3
3.17.3

Open the chart page →

5,941
kubeservice-namespace-node-affinitykubservice-chartsVerified publisher1.1.21 of 5See more

kubeservice-namespace-node-affinity kubservice-charts 1.1.2

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
helm.sh/helm/v3@v3.12.3
3.17.3

Open the chart page →

6,872
vcluster-k0sloftVerified publisher0.0.0-ci.31 of 2See more

vcluster-k0s loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
helm.sh/helm/v3@v3.10.3
3.17.3

Open the chart page →

3,136
chartmuseummike75151.2.01 of 1See more

chartmuseum mike7515 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
helm.sh/helm/v3@v3.9.0
3.17.3

Open the chart page →

3,168
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
helm.sh/helm/v3@v3.12.1
3.17.3

Open the chart page →

2,939
artifact-hubsoftonic1.19.04 of 8See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
helm.sh/helm/v3@v3.12.1
3.17.3
artifacthub/hub:v1.19.0111918d8c399
helm.sh/helm/v3@v3.15.2
3.17.3
artifacthub/scanner:v1.19.0323d026e78c3
helm.sh/helm/v3@v3.14.2
3.17.3
artifacthub/tracker:v1.19.06596c8c4d955
helm.sh/helm/v3@v3.15.2
3.17.3

Open the chart page →

14,491
gloosolo-gloo-edge0.0.0-fork2 of 5See more

gloo solo-gloo-edge 0.0.0-fork

2 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
quay.io/solo-io/discovery:0.0.0-fork5b62aaade3c9
helm.sh/helm/v3@v3.6.3
3.17.3
quay.io/solo-io/gloo:0.0.0-fork9a6c84560d44
helm.sh/helm/v3@v3.6.3
3.17.3

Open the chart page →

9,224
guardrails-agent-kubernetesturbotVerified publisher0.3.01 of 1See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
helm.sh/helm/v3@v3.14.2
3.17.3

Open the chart page →

4,020
upbot-operatorupbot-operator0.0.201 of 2See more

upbot-operator upbot-operator 0.0.20

1 of the 2 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
alpine/k8s:1.28.13e5c0b053fed7
helm.sh/helm/v3@v3.11.2
3.17.3

Open the chart page →

4,460
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
helm.sh/helm/v3@v0.0.0-20240814142712-fa9efb07d9d8
3.17.3

Open the chart page →

5,225
aktoakto0.2.01 of 7See more

akto akto 0.2.0

1 of the 7 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
helm.sh/helm/v3@v3.13.1
3.17.3

Open the chart page →

13,613
akto-hybrid-redactakto1.44.41 of 5See more

akto-hybrid-redact akto 1.44.4

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
helm.sh/helm/v3@v3.13.1
3.17.3

Open the chart page →

4,777
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
helm.sh/helm/v3@v3.13.1
3.17.3

Open the chart page →

6,486
akto-mini-testing-kafkaakto1.42.11 of 5See more

akto-mini-testing-kafka akto 1.42.1

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
helm.sh/helm/v3@v3.13.1
3.17.3

Open the chart page →

6,397

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
helm.sh/helm/v3@v3.8.0
3.17.3
1
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
helm.sh/helm/v3@v3.7.1
3.17.3
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
helm.sh/helm/v3@v3.3.4
3.17.3
1
quay.io/solo-io/discovery:0.0.0-fork5b62aaade3c9
helm.sh/helm/v3@v3.6.3
3.17.3
1
quay.io/solo-io/gloo:0.0.0-fork9a6c84560d44
helm.sh/helm/v3@v3.6.3
3.17.3
1
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.17.3
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
helm.sh/helm/v3@v3.7.0
3.17.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.