CVE-2025-55199 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-55199?
CVE-2025-55199 is a medium-severity vulnerability in helm, published on 13 Aug 2025.
Official description
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.
Weakness: CWE-770
Which versions are affected by CVE-2025-55199?
5 open source packages ship an affected version, including helm.sh/helm/v3, helm and helm.sh/helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm.sh/helm/v3 Go | All versions | 3.18.5 |
helm.sh/helm/v3 Go | All versions | 3.18.5 |
helm.sh/helm/v3 Go | All versions | 3.18.5 |
helm Bitnami | All versions | 3.18.5 |
helm.sh/helm Go | All versions | None |
Linux distribution packages (2)
helm openSUSE:Tumbleweed | All versions | 4.1.1-3.1 |
helm3 openSUSE:Tumbleweed | All versions | 3.20.0-2.1 |
Products include Helm Helm.
How do I fix CVE-2025-55199?
Upgrade helm.sh/helm/v3 to 3.18.5 or later.
Is CVE-2025-55199 being exploited?
There is no known exploitation of CVE-2025-55199 in the wild and no public exploit code.
Other vulnerabilities in helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
Sources
Also known as AZL-66318, BIT-helm-2025-55199, CLEANSTART-2026-SI21750, CLEANSTART-2026-XR94463, CLEANSTART-2026-ZE96570, ECHO-48a3-dcb9-730d and 30 more.