Allocation of Resources Without Limits or Throttling in Helm - CVE-2025-32386

Vulnerability identifier: #VU112039

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32386

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). A remote attacker can trick the victim into opening this specially crafted chart to cause memory exhaustion and the application to be terminated.

Helm
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Containers Module
openSUSE Leap
Kubecost Self Hosted
IBM Cloud Pak for Watson AIOps
IBM Fusion HCI
Cloud Pak for Data
helm-mirror-debuginfo
helm-mirror

Install updates from vendor's website.

Helm - update to 3.17.3
IBM Fusion HCI - update to 2.11.0
IBM Cloud Pak for Watson AIOps - update to 4.10.0
Cloud Pak for Data - update to 5.0.1
helm-mirror-debuginfo - update to 0.3.1-150000.1.18.2
helm-mirror - update to 0.3.1-150000.1.18.2

• https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7
• https://github.com/helm/helm/security/advisories/GHSA-4hfp-h4cw-hj8p

• Allocation of Resources Without Limits or Throttling in Helm
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• SUSE update for helm-mirror
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Kubecost Self Hosted