Allocation of Resources Without Limits or Throttling in Helm

1) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU112039

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-32386

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). A remote attacker can trick the victim into opening this specially crafted chart to cause memory exhaustion and the application to be terminated.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Helm: 1.0 - 3.17.2

CPE2.3

• cpe:2.3:a:the_helm_project:helm:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:the_helm_project:helm:1.1:*:*:*:*:*:*:*
• cpe:2.3:a:the_helm_project:helm:1.2:*:*:*:*:*:*:*

External links

https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7
https://github.com/helm/helm/security/advisories/GHSA-4hfp-h4cw-hj8p

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.