GHSA-x6r5-vxfg-gq3v critical
Helm Improper Certificate Validation
Affected range
SEMVER: introduced 0; fixed 2.7.2SEMVER: introduced 0; fixed 2.7.2+incompatibleFixed versions: 2.7.2, 2.7.2+incompatible
helm.sh/helm
Go package metadata, published advisories, affected versions, and known-exploitation evidence.
Go latest v2.17.0+incompatible
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
v2.17.0+incompatible
Published advisories match this version
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
9 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-p5pc-m4q7-7qm9 critical
Helm Unsafe Link Following
Affected range
SEMVER: introduced 2.0.0; fixed 2.15.2SEMVER: introduced 2.0.0+incompatible; fixed 2.15.2+incompatibleFixed versions: 2.15.2, 2.15.2+incompatible
GHSA-xrxm-mvqm-r553 moderate
Helm Path Traversal
Affected range
SEMVER: introduced 2.0.0; fixed 2.12.2SEMVER: introduced 2.0.0+incompatible; fixed 2.12.2+incompatibleFixed versions: 2.12.2, 2.12.2+incompatible
Aliases are never checked in helm
Affected range
SEMVER: introduced 0; fixed 2.16.11Fixed versions: 2.16.11
Improper Sanitizing of plugin names in helm
Affected range
SEMVER: introduced 0; fixed 2.16.11Fixed versions: 2.16.11
Repository index file allows for duplicates of the same chart entry in helm
Affected range
SEMVER: introduced 0; fixed 2.16.11Fixed versions: 2.16.11
plugin.yaml file allows for duplicate entries in helm
Affected range
SEMVER: introduced 2.0.0; fixed 2.16.11Fixed versions: 2.16.11
GO-2025-3887 unknown
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm
Affected range
SEMVER: introduced 0 GO-2025-3888 unknown
Helm May Panic Due To Incorrect YAML Content in helm.sh/helm
Affected range
SEMVER: introduced 0