p PatchFirst

PatchFirst · Latest vulnerabilities

helm vulnerabilities

Vulnerabilities published for helm in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 12

  2. SUSE-SU-2026:4417-1

    Not ratedFix available

    Security update for helm

    This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573)

    helmOperating systems
    • Update to 3.22.0-150000.1.99.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. SUSE-SU-2026:4175-1

    Not ratedFix available

    Security update for helm

    This update for helm fixes the following issues: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644). - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.co

    helmOperating systems
    • Update to 3.21.3-150000.1.96.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. SUSE-SU-2026:3882-1

    Not ratedFix available

    Security update for helm

    This update for helm fixes the following issues: - CVE-2026-41178: `go.opentelemetry.io/otel/baggage`,`go.opentelemetry.io/otel/propagation`: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514). Changes for helm: - Bump vendor to address various security issues: * golang.org/x/[email protected] * oras.land/oras-go/[email protected]

    helmOperating systems
    • Update to 3.21.3-150000.1.93.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. SUSE-SU-2026:3342-1

    Not ratedFix available

    Security update for helm

    This update for helm fixes the following issues: Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598). - CVE-2026-56852: golang.org/x/text/unicode/norm: handling input containing truncated or invalid UTF-8 bytes can lead to an infinite loop (bsc#1271997). Other updates and bugfixes: - Update x/text to 0.40.0. - Update x/net to 0.57.0. - Version 3.21.3: * Apply suggestions from code review 1ad6e68 (Benoit Tigeot). * fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e (Benoit Tigeot). *

    helmOperating systems
    • Update to 3.21.3-150000.1.85.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. SUSE-SU-2026:2823-1

    Not ratedFix available

    Security update for helm

    This update for helm fixes the following issues - Update to version 3.21.2 - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).

    helmOperating systems
    • Update to 3.21.2-150000.1.80.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →