High severity · published Dec 15, 2022
CVE-2022-23524
Helm is a tool for managing Charts, pre-configured Kubernetes resources
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Helm · Helm
3.0.0 before 3.10.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23524
Third Party Advisory
https://github.com/helm/helm/security/advisories/GHSA-6rx9-889q-vv2r
More from Helm
9.8
CVE-2019-18658
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive…
9.8
CVE-2019-1010275
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation
8.6
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
8.6
CVE-2025-53547
Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
8.6
CVE-2021-32690
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources)
