helm.sh/helm/v3

Go package metadata, published advisories, affected versions, and known-exploitation evidence.

Go latest v3.22.0

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

Latest version

v3.22.0

No matching published advisory returned

Known exploitation

No KEV match

Checked by exact CVE identifier

Highest advisory severity

High

22 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

GHSA-557j-xg8c-q2mm high

Helm vulnerable to Code Injection through malicious chart.yaml content

Sep 10, 2026

Affected range

SEMVER: introduced 3.18.0-rc.1; fixed 3.18.4SEMVER: introduced 0; fixed 3.17.4SEMVER: introduced 0; fixed 3.18.4

Fixed versions: 3.18.4, 3.17.4

CVE-2025-53547 Source ↗Source ↗

GHSA-r53h-jv2g-vpx6 high

Helm's Missing YAML Content Leads To Panic

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.14.2

Fixed versions: 3.14.2

CVE-2024-26147 Source ↗Source ↗

GHSA-q8q8-93cv-v6h8 high

Lookup function information discolosure in helm

Sep 10, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.1.3

Fixed versions: 3.1.3

CVE-2020-11013 Source ↗Source ↗

GHSA-cjjc-xp8v-855w high

Helm uses crypto package vulnerable to panic from malformed X.509 certificate

Sep 10, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.1.0

Fixed versions: 3.1.0

CVE-2020-7919 Source ↗Source ↗

GHSA-hr2v-4r36-88hr moderate

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.20.2

Fixed versions: 3.20.2

CVE-2026-35206 Source ↗Source ↗

GHSA-5xqw-8hwv-wg92 moderate

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.17.3

Fixed versions: 3.17.3

CVE-2025-32387 Source ↗Source ↗

GHSA-f9f8-9pmf-xv68 moderate

Helm May Panic Due To Incorrect YAML Content

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.18.5

Fixed versions: 3.18.5

CVE-2025-55198 Source ↗Source ↗

GHSA-9h84-qmv7-982p moderate

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.18.5

Fixed versions: 3.18.5

CVE-2025-55199 Source ↗Source ↗

GHSA-4hfp-h4cw-hj8p moderate

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.17.3

Fixed versions: 3.17.3

CVE-2025-32386 Source ↗Source ↗

GHSA-v53g-5gjp-272r moderate

Helm dependency management path traversal

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.14.1

Fixed versions: 3.14.1

CVE-2024-25620 Source ↗Source ↗

GHSA-pwcw-6f5g-gxf8 moderate

Helm vulnerable to information disclosure via getHostByName Function

Sep 10, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.11.1SEMVER: introduced 0; fixed 3.11.1

Fixed versions: 3.11.1

CVE-2023-25165 Source ↗Source ↗

GHSA-6rx9-889q-vv2r moderate

Helm vulnerable to denial of service through string value parsing

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.10.3

Fixed versions: 3.10.3

CVE-2022-23524 Source ↗Source ↗

GHSA-53c4-hhmh-vw5q moderate

Helm vulnerable to denial of service through through repository index file

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.10.3

Fixed versions: 3.10.3

CVE-2022-23525 Source ↗Source ↗

GHSA-67fx-wx78-jx33 moderate

Helm vulnerable to denial of service through schema file

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.10.3

Fixed versions: 3.10.3

CVE-2022-23526 Source ↗Source ↗

GHSA-7hfp-qfw3-5jxh moderate

Helm Vulnerable to denial of service through string value parsing

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.9.4

Fixed versions: 3.9.4

CVE-2022-36055 Source ↗Source ↗

GHSA-56hp-xqp3-w2jf moderate

Helm passes repository credentials to alternate domain

Sep 10, 2026

Affected range

SEMVER: introduced 0; fixed 3.6.1

Fixed versions: 3.6.1

CVE-2021-32690 Source ↗Source ↗

GHSA-c38g-469g-cmgx moderate

Improper Neutralization of Special Elements in Output in helm.sh/helm/v3

Jul 8, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.5.2

Fixed versions: 3.5.2

CVE-2021-21303 Source ↗Source ↗

GHSA-9vp5-m38w-j776 low

Aliases are never checked in helm

Jul 8, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.3.2

Fixed versions: 3.3.2

CVE-2020-15184 Source ↗Source ↗

GHSA-m54r-vrmv-hw33 low

Improper Sanitizing of plugin names in helm

Jul 8, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.3.2

Fixed versions: 3.3.2

CVE-2020-15186 Source ↗Source ↗

GHSA-jm56-5h66-w453 low

Repository index file allows for duplicates of the same chart entry in helm

Jul 8, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.3.2

Fixed versions: 3.3.2

CVE-2020-15185 Source ↗Source ↗

GHSA-c52f-pq47-2r9j low

plugin.yaml file allows for duplicate entries in helm

Jul 8, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.3.2

Fixed versions: 3.3.2

CVE-2020-15187 Source ↗Source ↗

GHSA-qq3j-xp49-j73f low

Plugin archive directory traversal in Helm

Jul 8, 2026

Affected range

SEMVER: introduced 3.0.0; fixed 3.2.4

Fixed versions: 3.2.4

CVE-2020-4053 Source ↗Source ↗