BIT-helm-2025-55199

    Dashboard / Vulnerabilities / BIT-helm-2025-55199

    BIT-helm-2025-55199

    Published: 18 Aug 2025Last Modified: 8 Sept 2026

    Summary: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

    Details: Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.

    References: https://github.com/helm/helm/commit/b78692c18f0fb38fe5ba4571a674de067a4c53a5, https://github.com/helm/helm/security/advisories/GHSA-9h84-qmv7-982p, https://nvd.nist.gov/vuln/detail/CVE-2025-55199

    Affected packages

    Package

    Name: helm

    Purl: pkg:bitnami/helm

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.18.5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-helm-2025-55199 | CVE-DB