Security update for helm
This update for helm rebuilds it against the current go security release.
- Update to 3.22.0-150000.1.101.1
Published Updated
PatchFirst · Latest vulnerabilities
helm vulnerabilities
Vulnerabilities published for helm in the last 30 days: 2. Listed in the KEV catalogue: 0.
Vulnerabilities: 14
Security update for helm
This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573)
- Update to 3.22.0-150000.1.99.1
Published UpdatedSecurity update for helm
This update for helm fixes the following issues: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644). - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.co
- Update to 3.21.3-150000.1.96.1
Published UpdatedSecurity update for helm
This update for helm fixes the following issues: - CVE-2026-41178: `go.opentelemetry.io/otel/baggage`,`go.opentelemetry.io/otel/propagation`: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514). Changes for helm: - Bump vendor to address various security issues: * golang.org/x/[email protected] * oras.land/oras-go/[email protected]
- Update to 3.21.3-150000.1.93.1
Published UpdatedSecurity update for helm
This update for helm rebuilds it against the current go security release.
- Update to 3.21.3-150000.1.87.1
Published UpdatedSecurity update for helm
This update for helm fixes the following issues: Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598). - CVE-2026-56852: golang.org/x/text/unicode/norm: handling input containing truncated or invalid UTF-8 bytes can lead to an infinite loop (bsc#1271997). Other updates and bugfixes: - Update x/text to 0.40.0. - Update x/net to 0.57.0. - Version 3.21.3: * Apply suggestions from code review 1ad6e68 (Benoit Tigeot). * fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e (Benoit Tigeot). *
- Update to 3.21.3-150000.1.85.1
Published UpdatedSecurity update for helm
This update for helm rebuilds it against the current go security release.
- Update to 3.21.2-150000.1.82.1
Published UpdatedSecurity update for helm
This update for helm fixes the following issues - Update to version 3.21.2 - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
- Update to 3.21.2-150000.1.80.1
Published UpdatedSecurity update for helm
This update for helm rebuilds it against the current go security release.
- Update to 3.21.0-150000.1.77.1
Published UpdatedSecurity update for helm
This update for helm rebuilds it against the current go 1.25 security release.
- Update to 3.19.1-150000.1.66.1
Published UpdatedSecurity update for helm
This update for helm rebuilds it against the current GO security release.
- Update to 3.19.1-150000.1.64.1
Published UpdatedSecurity update for helm
This update for helm rebuilds it against the current GO security release.
- Update to 3.19.1-150000.1.62.1
Published UpdatedSecurity update for helm
This update for helm fixes the following issues: - Update to version 3.19.1 - CVE-2025-53547: Fixed local code execution in Helm Chart. (bsc#1246152) - CVE-2025-58190: Fixed excessive memory consumption by `html.ParseFragment` when processing specially crafted input. (bsc#1251649) - CVE-2025-47911: Fixed various algorithms with quadratic complexity when parsing HTML documents. (bsc#1251442)
- Update to 3.19.1-150000.1.57.1
Published UpdatedSecurity update for helm
This update for helm fixes the following issues: Update to version 3.17.1: - CVE-2024-45338: Fixed denial of service due to non-linear parsing of case-insensitive content (bsc#1235318). - CVE-2024-45337: Fixed misuse of ServerConfig.PublicKeyCallback to prevent authorization bypass in golang.org/x/crypto (bsc#1234482).
- Update to 3.17.1-150000.1.41.1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.