CVE-2025-32387

Medium

Advisory

Published 9 Apr 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 154; of 17,781 indexed, latest versions
Container images: 157; deployed by those charts
Fix available: 1 of 2; affected packages

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Carried by container images the latest versions of 154 of 17,781 indexed charts deploy, on 157 images.

Affected package	Affected versions	Fixed in	Images
helm.sh/helm/v3golang	v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+66 more	3.17.3	157
helmdeb	3.18.1-1	no fix listed	1

OSV records: GHSA-5xqw-8hwv-wg92 UBUNTU-CVE-2025-32387
Also known as: BIT-helm-2025-32387, GO-2025-3602

Charts affected

154 by stars

Chart

Latest

Affected images

Radar Score

switchbladeswitchblade

0.0.19

1 of 1 See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container image	Digest	Package	Fixed in
public.ecr.aws/boundless-software/switchblade :release-v0.0.19-lcm	01d8413d5075	helm.sh/helm/v3@v3.14.3	3.17.3

Open the chart page →

1,360

harbor-scanner-trivytrivy-operator

0.31.2

1 of 1 See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	helm.sh/helm/v3@v3.14.2	3.17.3

Open the chart page →

2,477

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-32387.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	helm.sh/helm/v3@v3.11.0	3.17.3

Open the chart page →

6,232

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-32387.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.17.3

Open the chart page →

13,677

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/open-cluster-management/multicluster-mesh-addon :latest	3e010e1188f1	helm.sh/helm/v3@v3.8.0	3.17.3	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	helm.sh/helm/v3@v3.7.1	3.17.3	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	helm.sh/helm/v3@v3.3.4	3.17.3	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	helm.sh/helm/v3@v3.6.3	3.17.3	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	helm.sh/helm/v3@v3.6.3	3.17.3	1
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e	3.17.3	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	helm.sh/helm/v3@v3.7.0	3.17.3	1