CVE-2025-32386: Helm Out of Memory Termination Due to Malicious Chart Archive
Summary
CVE-2025-32386: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination. Affects helm.sh/helm/v3 versions < 3.17.3. Fixed in 3.17.3. How to fix ↓
Also tracked for
- helm · Bitnami
The same CVE-2025-32386 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Helm is a widely used package manager for Kubernetes, enabling users to define, install, and manage applications on Kubernetes clusters. It simplifies the deployment process by allowing users to package their applications into charts, which are collections of files that describe a related set of Kubernetes resources. However, Helm is susceptible to vulnerabilities, particularly when handling chart archives that can be crafted to exploit memory management issues.
Vulnerability Detail
A vulnerability has been identified in Helm where a specially crafted chart archive can cause the application to consume excessive memory, leading to an out of memory (OOM) termination. This issue arises when a chart archive is designed to expand significantly larger when uncompressed compared to its compressed size, potentially exceeding 800 times the original size. This can result in the Helm client or SDK exhausting available memory resources, causing the application to crash.
How To Fix
Latest published version: v3.22.1 as of 22 Oct 2026
go get helm.sh/helm/v3@v3.22.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.17.3
This is the first release that contains the fix.
go get helm.sh/helm/v3@v3.17.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should ensure that any chart archive files loaded by Helm do not contain excessively large files that could lead to memory exhaustion. This may involve reviewing and limiting the size of files included in chart archives.
Conclusion
In summary, CVE-2025-32386 presents a significant risk to Helm users by allowing maliciously crafted chart archives to cause memory exhaustion and application termination. Users are strongly advised to update to the patched version 3.17.3 and implement workarounds to mitigate risks until they can upgrade.
See every vulnerability recorded for helm.sh/helm/v3 →
FAQ
CVE-2025-32386 is a vulnerability in Helm that allows specially crafted chart archives to cause out of memory termination.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to Helm crashing due to memory exhaustion, which may disrupt application deployments and management on Kubernetes.
You can update Helm to version 3.17.3 or later using the command: 'helm upgrade --install <release-name> <chart-name> --version 3.17.3'.
If an immediate update is not possible, review and limit the size of files in chart archives to prevent memory exhaustion.
References
Related vulnerabilities
Recent vulnerabilities recorded for helm.sh/helm/v3.
