CVE-2022-36055

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. The _strvals_ package contains a parser that turns strings in to Go structures. The _strvals_ package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing an out of memory panic. Applications that use the _strvals_ package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been resolved in 3.9.4. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

• CWE-400
• CWE-770

• https://github.com/helm/helm/releases/tag/v3.9.4Release Notes, Third Party Advisory
• https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxhThird Party Advisory
• https://github.com/helm/helm/releases/tag/v3.9.4Release Notes, Third Party Advisory
• https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxhThird Party Advisory

Published

Sep 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36049Flux2 is a tool for keeping Kubernetes clusters in sync with…7.5
• CVE-2022-3605The WP CSV Exporter WordPress plugin before 1.3.7 does not p…7.8
• CVE-2022-36051ZITADEL combines the ease of Auth0 and the versatility of Ke…8.8
• CVE-2022-36052Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36053Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36054Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36056Cosign is a project under the sigstore organization which ai…5.5
• CVE-2022-36057Discourse-Chat is an asynchronous messaging plugin for the D…4.8
• CVE-2022-36058Elrond go is the go implementation for the Elrond Network pr…7.5
• CVE-2022-36059matrix-js-sdk is a Matrix messaging protocol Client-Server S…5.3
• CVE-2022-3606A vulnerability was found in Linux Kernel. It has been class…5.5
• CVE-2022-36060matrix-react-sdk is a Matrix chat protocol SDK for React Jav…5.3