Skip to main content

Allocation of Resources Without Limits or Throttling in github.com/helm/helm

CVE-2025-55199

  • github.com/helm/helm
  • github.com/helm/helm/v3
  • github.com/kubernetes/deployment-manager
  • github.com/kubernetes/helm
  • github.com/kubernetes/helm/v3
  • helm.sh/helm
  • helm.sh/helm/v3
  • helm.sh/helm/v3/v3
  • k8s.io/helm
  • k8s.io/Helm
  • k8s.io/helm/v3
Medium
6.5/10

Summary

Helm is a package manager for Charts for Kubernetes. In versions through 2.17.0 and 3.x prior to 3.18.5, it is possible to craft a "JSON Schema" file in a manner which could cause Helm to use all available memory and have an Out of Memory (OOM) termination. This issue has been resolved in Helm version 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of "$ref" pointing to "/dev/zero".

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published