Technology · Go

helm.sh/helm/v3 (Go) vulnerabilities

Updated 28 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 23 vulnerabilities in helm.sh/helm/v3 (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-35206, was published on 10 April 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

About helm.sh/helm/v3 (Go)

A package manager for Kubernetes that automates the deployment and management of applications using charts.

Homepage

Latest helm.sh/helm/v3 (Go) vulnerabilities

CVE-2026-35206: Helm path traversal via Chart.yaml name dot-segmentmediumCVSS 4EPSS 0.2%10 Apr 2026
CVE-2025-55198: GO-2025-3888 - Helm May Panic Due To Incorrect YAML Content in helm.sh/helmlowCVSS 3.1EPSS 0.3%18 Aug 2025
CVE-2025-55199: GO-2025-3887 - Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helmlowCVSS 3.1EPSS 0.3%18 Aug 2025
CVE-2025-53547: GO-2025-3802 - Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helmlowCVSS 3.1EPSS 0.4%21 Jul 2025
CVE-2025-32386: GO-2025-3601 - Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helmlowCVSS 3.1EPSS 0.4%10 Apr 2025
CVE-2025-32387: GO-2025-3602 - Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helmlowCVSS 3.1EPSS 0.5%10 Apr 2025
CVE-2024-26147: GO-2024-2575 - Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3lowCVSS 3.1EPSS 0.9%4 Jun 2024
CVE-2019-25210: Withdrawn Advisory: Helm shows secrets in clear textlowCVSS 3.1EPSS 0.7%3 Mar 2024
CVE-2024-25620: GO-2024-2554 - Path traversal in helm.sh/helm/v3lowCVSS 3.1EPSS 0.6%29 Feb 2024
CVE-2023-25165: GO-2023-1547 - Information disclosure in helm.sh/helm/v3lowCVSS 3.1EPSS 0.8%14 Feb 2023
CVE-2022-23525: GO-2022-1165 - Denial of service via repository index file in helm.sh/helm/v3lowCVSS 3.1EPSS 0.9%22 Dec 2022
CVE-2022-23526: GO-2022-1166 - Denial of service via schema file in helm.sh/helm/v3lowCVSS 3.1EPSS 0.9%22 Dec 2022
CVE-2022-23524: GO-2022-1167 - Denial of service in string value parsing in helm.sh/helm/v3lowCVSS 3.1EPSS 0.8%14 Dec 2022
CVE-2021-21303: GO-2022-1040 - Insufficient sanitization of data files in helm.sh/helm/v3lowCVSS 3.1EPSS 1.0%18 Oct 2022
CVE-2022-36055: GO-2022-0962 - Denial of service through string value parsing in helm.sh/helm/v3lowCVSS 3.1EPSS 1.1%2 Sep 2022
CVE-2021-32690: GO-2022-0384 - Repository credentials passed to alternate domain in helm.sh/helm/v3lowCVSS 3.1EPSS 1.4%15 Jul 2022
CVE-2020-7919: GO-2022-0229 - Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobytelowCVSS 3.1EPSS 2.6%6 Jul 2022
CVE-2020-4053: Plugin archive directory traversal in HelmlowCVSS 3.1EPSS 1.5%23 Jun 2021
CVE-2020-11013: Lookup function information discolosure in helmlowCVSS 3.1EPSS 1.3%27 May 2021
CVE-2020-15187: plugin.yaml file allows for duplicate entries in helmlowCVSS 3.1EPSS 1.5%24 May 2021
CVE-2020-15186: Improper Sanitizing of plugin names in helmlowCVSS 3.1EPSS 1.0%24 May 2021
CVE-2020-15185: Repository index file allows for duplicates of the same chart entry in helmlowCVSS 3.1EPSS 0.9%24 May 2021
CVE-2020-15184: Aliases are never checked in helmlowCVSS 3.1EPSS 1.0%24 May 2021

Most severe helm.sh/helm/v3 (Go) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2026-35206: Helm path traversal via Chart.yaml name dot-segmentmediumCVSS 4EPSS 0.2%10 Apr 2026
CVE-2020-7919: GO-2022-0229 - Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobytelowCVSS 3.1EPSS 2.6%6 Jul 2022
CVE-2020-15187: plugin.yaml file allows for duplicate entries in helmlowCVSS 3.1EPSS 1.5%24 May 2021
CVE-2020-4053: Plugin archive directory traversal in HelmlowCVSS 3.1EPSS 1.5%23 Jun 2021
CVE-2021-32690: GO-2022-0384 - Repository credentials passed to alternate domain in helm.sh/helm/v3lowCVSS 3.1EPSS 1.4%15 Jul 2022
CVE-2020-11013: Lookup function information discolosure in helmlowCVSS 3.1EPSS 1.3%27 May 2021
CVE-2022-36055: GO-2022-0962 - Denial of service through string value parsing in helm.sh/helm/v3lowCVSS 3.1EPSS 1.1%2 Sep 2022
CVE-2021-21303: GO-2022-1040 - Insufficient sanitization of data files in helm.sh/helm/v3lowCVSS 3.1EPSS 1.0%18 Oct 2022
CVE-2020-15184: Aliases are never checked in helmlowCVSS 3.1EPSS 1.0%24 May 2021
CVE-2020-15186: Improper Sanitizing of plugin names in helmlowCVSS 3.1EPSS 1.0%24 May 2021

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/helm-sh-helm-v3.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "helm.sh/helm/v3 (Go) vulnerabilities", https://junglewise.ai/threats/technologies/helm-sh-helm-v3, 28 September 2026.