CVE-2020-7919: Panic in malformed certificate in Helm
Summary
CVE-2020-7919: Helm uses crypto package vulnerable to panic from malformed X.509 certificate. Affects github.com/helm/helm versions >= 2.0.0, < 2.16.8. Fixed in 2.16.8. How to fix ↓
Also tracked for
The same CVE-2020-7919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Helm is an open-source package manager for Kubernetes that simplifies the deployment and management of applications. It is written in Go and provides a command-line interface for interacting with Kubernetes clusters. The Helm core maintainers have identified a high severity security vulnerability in Go's crypto package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7919, exists in Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go). It allows attacks on clients resulting in a panic via a malformed X.509 certificate. This vulnerability may allow a remote attacker to cause a denial of service.
How To Fix
Latest published version: v2.17.0+incompatible as of 23 Oct 2026
go get github.com/helm/helm@v2.17.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.16.8
This is the first release that contains the fix.
go get github.com/helm/helm@v2.16.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is available for this vulnerability. It is recommended to upgrade to the fixed versions of Helm.
Conclusion
In conclusion, the CVE-2020-7919 vulnerability in Helm's crypto package allows a remote attacker to cause a denial of service by exploiting a panic in the handling of malformed X.509 certificates. Users are strongly advised to upgrade to the fixed versions of Helm or ensure that their Helm installations are compiled against the recommended Go version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/helm/helm →
FAQ
Helm is an open-source package manager for Kubernetes that simplifies the deployment and management of applications.
The vulnerability allows a remote attacker to cause a denial of service by exploiting a panic in the crypto package.
Upgrade to Helm 2.16.8 or Helm 3.1.0 and newer, or ensure that your Helm installation is compiled against Go 1.13.7 or later.
No, there is no workaround available. Upgrading to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the NVD advisory (CVE-2020-7919) and the Helm GitHub repository.
