products / helm

Helm

Helm is the Kubernetes package manager. Operators install and upgrade charts that render Kubernetes manifests and pull remote dependencies. NVD tracks the CLI and chart machinery as helm:helm with semver-style versions. Helm 2 and Helm 3 share that product identifier but carry different CVE sets.

api usage

Querying Helm

product slughelm
version format3.9.0, 3.18.5, 2.14.0
bash
curl "https://api.attestd.io/v1/check?product=helm&version=3.9.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Helm 3.9.0 is affected by CVE-2022-23524 (uncontrolled resource consumption in strvals parsing). The response shows risk_state: "high" because crafted chart values DoS the CLI without authentication.

json
{
  "product": "helm",
  "version": "3.9.0",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2022-23524",
    "CVE-2022-23525",
    "CVE-2022-23526",
    "CVE-2022-36049",
    "CVE-2022-36055",
    "CVE-2023-25165",
    "CVE-2024-25620",
    "CVE-2024-26147",
    "CVE-2025-32386",
    "CVE-2025-32387",
    "CVE-2025-53547",
    "CVE-2025-55198",
    "CVE-2025-55199",
    "CVE-2026-35206",
    "CVE-2026-62185",
    "CVE-2026-63308",
    "CVE-2026-66016"
  ],
  "cves": null,
  "max_epss": 0.01088,
  "last_updated": "2026-08-16T05:54:03.759070Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}
safe version

Helm 3.18.5 resolves CVE-2025-53547 on the 3.18 line and sits past the dependency-credential and strvals fixes from earlier 3.x trains.

bash
curl "https://api.attestd.io/v1/check?product=helm&version=3.18.5" \
  -H "Authorization: Bearer $ATTESTD_KEY"
notable cves

CVE history

Helm CVEs concentrate on chart package paths, dependency resolution (credential leakage and local code execution), and parser DoS in the values/string handling path. Helm 2 carried a critical path-handling issue. Helm 3 issues more often hit operators who resolve or update chart dependencies from untrusted sources.

CVEDescriptionAffectsCVSS
CVE-2019-18658
Malicious chart directory or package path loads sensitive files or enables code execution on Helm 2.≥2.0.0 <2.15.29.8
CVE-2021-32690
Chart dependency resolution leaks repository username and password to the dependency.<3.6.18.6
CVE-2025-53547
Crafted Chart.yaml plus a linked Chart.lock executes local code during dependency update.<3.17.4 / ≥3.18.0 <3.18.48.6
CVE-2022-23524
Uncontrolled resource consumption in strvals parsing DoSes Helm.≥3.0.0 <3.10.37.5
data sources

Single CPE namespace

NVD records Helm under one application CPE. Attestd maps the helm product slug to that namespace and matches the requested semver against published ranges.

cpe:2.3:a:helm:helmHelm 2.x and 3.x CLI / chart tooling

Query with the Helm release version string your cluster or CI binary reports. Chart package names are not product slugs.

related