CVE-2025-32387

What it actually does

A specially crafted JSON Schema embedded in a Helm chart triggers uncontrolled recursion or excessive stack allocation during schema processing, resulting in a stack overflow that crashes the Helm client or server process.

Why it matters to the business

Successful exploitation can interrupt Helm-based application deployments and upgrades, causing operational downtime for teams relying on chart installations; although EPSS remains low and no known exploitation or ransomware use exists, the vulnerability has been public for over 500 days and affects all unpatched Helm installations.

How an attack unfolds

An attacker creates a Helm chart containing a malicious JSON Schema engineered to cause stack exhaustion, then persuades a victim to perform helm install or helm upgrade against the chart; processing the schema during validation leads to the overflow and process termination.

How to fix it

Upgrade Helm to commit e4da49785aa6e6ee2b86efd5dd9e43400318262b or a later release containing the fix; avoid installing charts from untrusted sources until patched.

How to confirm the fix worked

Confirm the installed Helm binary reports a version containing commit e4da49785aa6e6ee2b86efd5dd9e43400318262b; re-test chart processing with known-good schemas and monitor for absence of crashes on previously problematic inputs.

Typical attack path

1. Craft a JSON Schema containing deeply nested structures or recursive references designed to exhaust stack memory
2. Package the schema inside a valid-looking Helm chart
3. Host the chart in a repository or deliver it via social engineering
4. Victim executes helm install, helm upgrade, or helm lint against the chart
5. Helm parser processes the schema and crashes due to stack overflow

How to detect it

Search Helm and system logs for sudden process terminations or stack overflow signals during chart operations; correlate with chart installation events from untrusted sources.

What your security team should do

• Immediately upgrade all Helm installations to the fixed commit
• Restrict chart sources to trusted repositories and require chart signing
• Add Helm process crash monitoring to existing alerting
• Review and regenerate any internal charts that embed custom JSON Schemas