Vulnerability · Published Aug 13, 2025 · Assigned by GitHub_M

CVE-2025-55199Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Medium 6.5

In plain English

A medium-severity resource allocation without limits in helm from helm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 70.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	helm.sh/helm	no fix listed	GO-2025-3887
Go	helm.sh/helm/v3	3.18.5	GHSA-9h84-qmv7-982p
Go	helm.sh/helm/v3	3.18.5	GO-2025-3887

Affected products (as reported)

Vendor	Product	Versions
helm	helm	< 3.18.5

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/helm/helm/security/advisories/GHSA-9h84-qmv7-982p x_refsource_CONFIRM
https://github.com/helm/helm/commit/b78692c18f0fb38fe5ba4571a674de067a4c53a5 x_refsource_MISC