CVE-2025-55198 — Use of Uninitialized Resource in Helm

CWE-908 — Use of Uninitialized Resource7 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 96.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
HelmHelm.sh Helm V3
Timeline
PublishedAug 14
Latest updateAug 18

Description

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5helm/helm< 3.18.5
▶NVDhelm/helm< 3.18.5
▶Gohelm.sh/helm_v3< 3.18.5

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Helm May Panic Due To Incorrect YAML Content in helm.sh/helm↗2025-08-18
▶
OSV
Helm May Panic Due To Incorrect YAML Content↗2025-08-14
▶
GHSA
Helm May Panic Due To Incorrect YAML Content↗2025-08-14
▶
CVEList
Helm May Panic Due To Incorrect YAML Content↗2025-08-13
▶

📋Vendor Advisories

2
Red Hat
helm.sh/helm/v3: Helm YAML Parsing Panic Vulnerability↗2025-08-13
▶
Microsoft
Helm May Panic Due To Incorrect YAML Content↗2025-08-12
▶
CVE-2025-55198 — Use of Uninitialized Resource in Helm | cvebase