CVE-2025-55198: Helm May Panic Due To Incorrect YAML Content
A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.
Impact
There are two areas of YAML validation that were impacted. First, when a Chart.yaml file had a null maintainer or the child or parent of a dependencies import-values could be parsed as something other than a string, helm lint would panic. Second, when an index.yaml had an empty entry in the list of chart versions Helm would panic on interactions with that repository.
Patches
This issue has been resolved in Helm v3.18.5.
Workarounds
Ensure YAML files are formatted as Helm expects prior to processing them with Helm.
References
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
Other sources
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55198?
CVE-2025-55198 has a severity rating that reflects a potential impact due to improper validation of type resulting in a panic.
How do I fix CVE-2025-55198?
To fix CVE-2025-55198, upgrade to Helm version 3.18.5 or later.
What vulnerability does CVE-2025-55198 address?
CVE-2025-55198 addresses an improper validation issue in Helm when parsing Chart.yaml and index.yaml files.
What versions of Helm are affected by CVE-2025-55198?
All versions of Helm prior to 3.18.5 are affected by CVE-2025-55198.
Is there a workaround for CVE-2025-55198?
A workaround for CVE-2025-55198 involves ensuring that YAML files are properly formatted.