Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7 cve-icon cve-icon cve-icon
https://github.com/helm/helm/security/advisories/GHSA-5xqw-8hwv-wg92 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-32387 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-32387 cve-icon
History

Thu, 10 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Apr 2025 14:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 09 Apr 2025 22:45:00 +0000

Type Values Removed Values Added
Description Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
Title Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
Weaknesses CWE-121
CWE-674
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-04-10T14:58:47.796Z

Reserved: 2025-04-06T19:46:02.463Z

Link: CVE-2025-32387

cve-icon Vulnrichment

Updated: 2025-04-10T14:58:34.576Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-04-09T23:15:37.903

Modified: 2025-04-11T15:40:10.277

Link: CVE-2025-32387

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-09T22:28:33Z

Links: CVE-2025-32387 - Bugzilla