Helm
Helm is the Kubernetes package manager. Operators install and upgrade charts that render Kubernetes manifests and pull remote dependencies. NVD tracks the CLI and chart machinery as helm:helm with semver-style versions. Helm 2 and Helm 3 share that product identifier but carry different CVE sets.
Querying Helm
helm3.9.0, 3.18.5, 2.14.0curl "https://api.attestd.io/v1/check?product=helm&version=3.9.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Helm 3.9.0 is affected by CVE-2022-23524 (uncontrolled resource consumption in strvals parsing). The response shows risk_state: "high" because crafted chart values DoS the CLI without authentication.
{
"product": "helm",
"version": "3.9.0",
"supported": true,
"risk_state": "high",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2022-23524",
"CVE-2022-23525",
"CVE-2022-23526",
"CVE-2022-36049",
"CVE-2022-36055",
"CVE-2023-25165",
"CVE-2024-25620",
"CVE-2024-26147",
"CVE-2025-32386",
"CVE-2025-32387",
"CVE-2025-53547",
"CVE-2025-55198",
"CVE-2025-55199",
"CVE-2026-35206",
"CVE-2026-62185",
"CVE-2026-63308",
"CVE-2026-66016"
],
"cves": null,
"max_epss": 0.01088,
"last_updated": "2026-08-16T05:54:03.759070Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Helm 3.18.5 resolves CVE-2025-53547 on the 3.18 line and sits past the dependency-credential and strvals fixes from earlier 3.x trains.
curl "https://api.attestd.io/v1/check?product=helm&version=3.18.5" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Helm CVEs concentrate on chart package paths, dependency resolution (credential leakage and local code execution), and parser DoS in the values/string handling path. Helm 2 carried a critical path-handling issue. Helm 3 issues more often hit operators who resolve or update chart dependencies from untrusted sources.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2019-18658 | Malicious chart directory or package path loads sensitive files or enables code execution on Helm 2. | ≥2.0.0 <2.15.2 | 9.8 |
CVE-2021-32690 | Chart dependency resolution leaks repository username and password to the dependency. | <3.6.1 | 8.6 |
CVE-2025-53547 | Crafted Chart.yaml plus a linked Chart.lock executes local code during dependency update. | <3.17.4 / ≥3.18.0 <3.18.4 | 8.6 |
CVE-2022-23524 | Uncontrolled resource consumption in strvals parsing DoSes Helm. | ≥3.0.0 <3.10.3 | 7.5 |
Single CPE namespace
NVD records Helm under one application CPE. Attestd maps the helm product slug to that namespace and matches the requested semver against published ranges.
cpe:2.3:a:helm:helmHelm 2.x and 3.x CLI / chart toolingQuery with the Helm release version string your cluster or CI binary reports. Chart package names are not product slugs.