Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Helm before 3.10.3 can crash from crafted input

CVE-2022-23524 · published 3 years ago
Summary

Helm versions older than 3.10.3 may run out of memory and stop working when they process specially crafted string values. This happens because the string‑parsing code can overflow the program’s call stack, causing it to stop. Upgrade Helm to version 3.10.3 or later, and if you use Helm’s SDK, check user‑supplied strings for extreme length before parsing them.

What to do
  • Update helm.sh helm to version 3.10.3.
  • Update helm helm to version 3.10.3 or later.
Affected software
Ecosystem VendorProductAffected versions
go helm.sh helm <= 3.10.2
Fix: upgrade to 3.10.3
– helm helm >= 3.0.0, < 3.10.3
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*
Original advisory text
Helm vulnerable to Denial of service through string value parsing
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published15 Dec 2022
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-6rx9-889q-vv2r · GHSA
CVE-2022-23524 · NVD
CVE-2022-23524 · OSV
Track software like this
Free during beta