This update for helm fixes the following issues:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265758).
- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin
(bsc#1261939).
- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin
provenance verification (bsc#1261935).
- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart
(bsc#1261938).
- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go
This update for helm fixes the following issues:
- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization
policies via mixed-case or canonical-case header matches (bsc#1278270).
- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS
servers (bsc#1278688).
This update for helm fixes the following issues:
- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST
request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length
headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to
exfiltrate credentials and refresh tokens (bsc#1270127).
- CVE-2026-5
This update for helm fixes the following issues:
Update to version 3.21.3.
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266598).
- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: missing validation in `auth.Client()` allows a malicious
registry to hijack Bearer token realms to exfiltrate credentials and refresh tokens (bsc#1270127).
- CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing truncated/invalid UTF-8 input can
lead to infinite loop (bsc#1271997).
Changes for helm:
- Update `x/text`
This update for helm fixes the following issue
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266598).
Changes for helm:
- update to 3.21.2:
* chore(deps): bump the k8s-io group with 2 updates 1259634
(dependabot[bot])
* fixes b52e276 (Matheus Pimenta)
* chore(deps): bump the k8s-io group across 1 directory with 2
updates 3342dbf (dependabot[bot])
- Update to version 3.21.1:
* Fixed nil pointer panic that could happen with helm template in
ClientOnly flows. Now correctly returns a template error #31920
* Bumped golang.org/x/
This update for helm fixes the following issues:
Update to version 3.19.1 (bsc#1251649, CVE-2025-58190, bsc#1251442, CVE-2025-47911):
* chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29
* jsonschema: warn and ignore unresolved URN $ref to match v3.18.4
* Avoid "panic: interface conversion: interface {} is nil"
* Fix `helm pull` untar dir check with repo urls
* chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
* Add timeout flag to repo add and update flags
* chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.43.0
Update to version 3.19.0:
* fix: use username and password if provided
This update for helm fixes the following issues:
Update to version 3.18.4 (bsc#1246152, CVE-2025-53547):
* Disabling linter due to unknown issue f20a4ad (Matt Farina)
* build(deps): bump the k8s-io group with 7 updates 563b094
(dependabot[bot])
* Updating link handling 00de613 (Matt Farina)
This update for helm fixes the following issues:
Update to version 3.18.3:
* build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0
6838ebc (dependabot[bot])
* fix: user username password for login 5b9e2f6 (Terry Howe)
* Update pkg/registry/transport.go 2782412 (Terry Howe)
* Update pkg/registry/transport.go e66cf6a (Terry Howe)
* fix: add debug logging to oci transport 191f05c (Terry Howe)
Update to version 3.18.2:
* fix: legacy docker support broken for login 04cad46 (Terry
Howe)
* Handle an empty registry config file. bc9f8a2 (Matt Farina)
Update to version 3.18.1:
* Notes:
- This release fixes regre
This update for helm fixes the following issues:
- Update to version 3.17.2 (bsc#1238688, CVE-2025-22870):
* Updating to 0.37.0 for x/net
* build(deps): bump the k8s-io group with 7 updates
- Update to version 3.17.1:
* merge null child chart objects
* build(deps): bump the k8s-io group with 7 updates
* fix: check group for resource info match
- Update to 3.17.0 (bsc#1235318, CVE-2024-45338):
Full changelog:
https://github.com/helm/helm/releases/tag/v3.17.0
* Notable Changes
- Allow pulling and installation by OCI digest
- Annotations and dependencies are now in chart metadata output
- New --take-ownership