CVE-2025-55199
ADVISORY - githubSummary
A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.
Impact
A malicious chart can point $ref in values.schema.json to a device (e.g. /dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.
Patches
This issue has been resolved in Helm v3.18.5.
Workarounds
Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of $ref pointing to /dev/zero.
References
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
Common Weakness Enumeration (CWE)
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling
NIST
2.8
CVSS SCORE
6.5mediumGitHub
2.8
CVSS SCORE
6.5mediumAlpine
-
GoLang
-
Bitnami
BIT-helm-2025-55199
2.8
CVSS SCORE
6.5mediumRed Hat
2.8
CVSS SCORE
6.5mediumChainguard
CGA-24hx-3rrj-wpmv
-
Chainguard
CGA-269q-8xj7-4g35
-
Chainguard
CGA-284f-7p7r-243x
-
Chainguard
CGA-2mgv-6mp7-8rhv
-
Chainguard
CGA-2rp9-rh98-g72q
-
Chainguard
CGA-3m69-2j52-v7wq
-
Chainguard
CGA-3x37-cr97-gg76
-
Chainguard
CGA-3xvh-gg3h-qx8w
-
Chainguard
CGA-46rw-6cq5-fv5m
-
Chainguard
CGA-5cf7-fq88-hj3f
-
Chainguard
CGA-5cjj-h9g4-9xhm
-
Chainguard
CGA-6444-w5gv-xfh5
-
Chainguard
CGA-683r-w6xx-4r37
-
Chainguard
CGA-6c2w-6hrw-cj76
-
Chainguard
CGA-6cfp-8gwx-f3p7
-
Chainguard
CGA-6cgq-rw37-rq56
-
Chainguard
CGA-7jj6-6jgf-5pf3
-
Chainguard
CGA-7prw-pq2m-35w3
-
Chainguard
CGA-7qrv-mwqh-74mm
-
Chainguard
CGA-82q6-g449-vxwq
-
Chainguard
CGA-8w68-rfm3-8gq2
-
Chainguard
CGA-99wj-h6f6-8q59
-
Chainguard
CGA-c3x9-wxm4-7693
-
Chainguard
CGA-c5qp-6mm5-j963
-
Chainguard
CGA-c7gv-jxxw-pcj9
-
Chainguard
CGA-cgvr-46wm-qw9g
-
Chainguard
CGA-cwrv-mqgx-pxh5
-
Chainguard
CGA-f3q6-gh4f-34vg
-
Chainguard
CGA-f6g6-2h65-j763
-
Chainguard
CGA-f738-j59r-2838
-
Chainguard
CGA-fjc2-4rqh-c53r
-
Chainguard
CGA-fpr4-w3f3-67w7
-
Chainguard
CGA-fw9h-c5hm-h48g
-
Chainguard
CGA-g6h6-3vpf-x398
-
Chainguard
CGA-gh32-f6r5-jj69
-
Chainguard
CGA-gmg8-5rxv-9wmg
-
Chainguard
CGA-gpwr-gp4r-hx6m
-
Chainguard
CGA-gvmp-5367-9h36
-
Chainguard
CGA-h3g8-fhj4-q99r
-
Chainguard
CGA-h863-5g89-qc54
-
Chainguard
CGA-hff5-7w7v-qfrx
-
Chainguard
CGA-hhc3-xj7v-fg42
-
Chainguard
CGA-hjqc-589g-m754
-
Chainguard
CGA-j9mv-fm49-jrhr
-
Chainguard
CGA-jq76-h499-xq49
-
Chainguard
CGA-jrhc-8cph-xc7m
-
Chainguard
CGA-jwqr-hgmj-mqwg
-
Chainguard
CGA-jx5f-2qpj-hfr2
-
Chainguard
CGA-jxx4-xj4r-q6x9
-
Chainguard
CGA-m9h9-w7jh-v5g7
-
Chainguard
CGA-mf46-q9pj-j344
-
Chainguard
CGA-mwhx-wp3x-99hr
-
Chainguard
CGA-p4g5-rwfm-29rv
-
Chainguard
CGA-p634-vc43-mj6v
-
Chainguard
CGA-q4vv-cf5r-6m7h
-
Chainguard
CGA-q562-7cgc-3hpj
-
Chainguard
CGA-q8m3-wfhg-6c8v
-
Chainguard
CGA-qfjw-5fpm-v877
-
Chainguard
CGA-qm93-m6px-4g6g
-
Chainguard
CGA-qqrp-r5fj-h2p8
-
Chainguard
CGA-qwjp-c337-3qxv
-
Chainguard
CGA-qxxx-47gj-q5qp
-
Chainguard
CGA-r3cc-qhvr-899g
-
Chainguard
CGA-r4g7-cc46-mvw9
-
Chainguard
CGA-r922-8fpq-57h9
-
Chainguard
CGA-rc73-jrv3-cp5v
-
Chainguard
CGA-rf22-fh3c-xj4g
-
Chainguard
CGA-rhph-8ccp-9r4r
-
Chainguard
CGA-rj44-22cf-jm5f
-
Chainguard
CGA-rmj8-3h2g-mvhr
-
Chainguard
CGA-rmqp-mcj6-8vx2
-
Chainguard
CGA-v37r-2x3j-h642
-
Chainguard
CGA-v4qg-q4h6-7f2g
-
Chainguard
CGA-vhcp-8mwp-g8fq
-
Chainguard
CGA-vhmw-mj38-wpc7
-
Chainguard
CGA-vq2f-2qg7-j6hq
-
Chainguard
CGA-vqgv-c3f7-jm4g
-
Chainguard
CGA-vqmp-r8fm-c8q2
-
Chainguard
CGA-w2j9-wrj2-26qr
-
Chainguard
CGA-wg28-rw6m-w4x3
-
Chainguard
CGA-wx7g-9g6p-r4j3
-
Chainguard
CGA-x84c-q5c4-xc3x
-
Chainguard
CGA-xjgp-2686-9fcx
-
Chainguard
CGA-xph3-rq4q-m6c2
-
Chainguard
CGA-xq33-6r49-h73c
-
Chainguard
CGA-xx5x-4jpg-2v9q
-
minimos
MINI-285r-hcwm-2hc9
-
minimos
MINI-2r7v-wc2q-72mp
-
minimos
MINI-457p-m5j8-345j
-
minimos
MINI-4mrx-fx72-5wm3
-
minimos
MINI-5r7f-r9pc-2866
-
minimos
MINI-62w8-2jcv-c8vv
-
minimos
MINI-6xqf-ph7f-497h
-
minimos
MINI-73j8-34f3-428q
-
minimos
MINI-7ph8-52qx-w9p5
-
minimos
MINI-cj28-89j7-3rf8
-
minimos
MINI-f6xc-v9mv-qgmw
-
minimos
MINI-hcww-q7wv-82cm
-
minimos
MINI-hvqh-65mg-5j3j
-
minimos
MINI-mpx8-vw96-p795
-
minimos
MINI-p9wv-7h5v-336x
-
minimos
MINI-q5rv-wr62-56w2
-
minimos
MINI-r227-pxqj-gp4f
-
minimos
MINI-rmjm-rm95-whwq
-
minimos
MINI-rr4r-4pv6-rrcr
-
minimos
MINI-rrxw-vq9w-wxpw
-
minimos
MINI-vjf5-9m54-25v2
-
minimos
MINI-vxqj-7x57-cvwr
-
minimos
MINI-xh7p-4p4f-3jxx
-