CVE-2025-32387 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
Attackers can cause a stack overflow and denial of service in Helm by providing a chart with a deeply nested JSON schema.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-32387?
CVE-2025-32387 is a medium-severity denial of service vulnerability in helm, published on 9 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
Which versions are affected by CVE-2025-32387?
4 open source packages ship an affected version, including helm.sh/helm/v3 and helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm.sh/helm/v3 Go | All versions | 3.17.3 |
helm.sh/helm/v3 Go | All versions | 3.17.3 |
helm.sh/helm/v3 Go | All versions | 3.17.3 |
helm Bitnami | All versions | 3.17.3 |
Products include Helm Helm.
How do I fix CVE-2025-32387?
Upgrade helm.sh/helm/v3 to 3.17.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-32387 being exploited?
There is no known exploitation of CVE-2025-32387 in the wild and no public exploit code.
Other vulnerabilities in helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
Sources
Also known as AZL-59979, AZL-60172, BIT-helm-2025-32387, CLEANSTART-2026-GF48427, CLEANSTART-2026-PV63985, CLEANSTART-2026-WC68837 and 13 more.