CVE-2025-55198 Helm May Panic Due To Incorrect YAML Content
Attackers can cause Helm to panic and crash by providing malformed YAML files, disrupting Kubernetes chart management operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-55198?
CVE-2025-55198 is a medium-severity denial of service vulnerability in helm, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.
Weakness: CWE-908
Which versions are affected by CVE-2025-55198?
5 open source packages ship an affected version, including helm.sh/helm/v3, helm and helm.sh/helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm.sh/helm/v3 Go | All versions | 3.18.5 |
helm.sh/helm/v3 Go | All versions | 3.18.5 |
helm.sh/helm/v3 Go | All versions | 3.18.5 |
helm Bitnami | All versions | 3.18.5 |
helm.sh/helm Go | All versions | None |
Products include Helm Helm.
How do I fix CVE-2025-55198?
Upgrade helm.sh/helm/v3 to 3.18.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-55198 being exploited?
There is no known exploitation of CVE-2025-55198 in the wild and no public exploit code.
Other vulnerabilities in helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
Sources
Also known as AZL-66315, BIT-helm-2025-55198, CLEANSTART-2026-CD99087, CLEANSTART-2026-JC23745, CLEANSTART-2026-ON36329, ECHO-dae0-c4a3-662c and 28 more.