SUSE-SU-2026:20685-1

Vulnerability from csaf_suse - Published: 2026-03-05 14:28 - Updated: 2026-09-16 19:34
Summary
Security update for helm
Severity
Moderate
Notes
Title of the patch: Security update for helm
Description of the patch: This update for helm fixes the following issues: - Update to version 3.19.1: * CVE-2025-47911: golang.org/x/net/html: Fixed various algorithms with quadratic complexity when parsing HTML documents (bsc#1251442) * CVE-2025-58190: golang.org/x/net/html: Fixed xcessive memory consumption by `html.ParseFragment` when processing specially crafted input (bsc#1251649) * jsonschema: warn and ignore unresolved URN $ref to match v3.18.4 * Avoid "panic: interface conversion: interface {} is nil" * Fix `helm pull` untar dir check with repo urls * Fix deprecation warning * Add timeout flag to repo add and update flags - Update to version 3.19.0: * bump version to v3.19.0 * fix: use username and password if provided * fix(helm-lint): fmt * fix(helm-lint): Add TLSClientConfig * fix(helm-lint): Add HTTP/HTTPS URL support for json schema references * chore(deps): bump the k8s-io group with 7 updates * fix: go mod tidy for v3 * fix Chart.yaml handling * Handle messy index files * json schema fix * fix: k8s version parsing to match original * Do not explicitly set SNI in HTTPGetter * Disabling linter due to unknown issue * Updating link handling * fix: user username password for login * Update pkg/registry/transport.go * fix: add debug logging to oci transport * fix: legacy docker support broken for login * fix: plugin installer test with no Internet * Handle an empty registry config file. * Prevent fetching newReference again as we have in calling method * Prevent failure when resolving version tags in oras memory store * fix(client): skipnode utilization for PreCopy * test: Skip instead of returning early. looks more intentional * test: tests repo stripping functionality * test: include tests for Login based on different protocol prefixes * fix(client): layers now returns manifest - remove duplicate from descriptors * fix(client): return nil on non-allowed media types * Fix 3.18.0 regression: registry login with scheme * Update pkg/plugin/plugin.go * Wait for Helm v4 before raising when platformCommand and Command are set * Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]" * build(deps): bump the k8s-io group with 7 updates * chore: update generalization warning message * fix: move warning to top of block * fix: govulncheck workflow * fix: replace fmt warning with slog * fix: add warning when ignore repo flag * feat: add httproute from gateway-api to create chart template - Update to version 3.18.6: * fix(helm-lint): fmt * fix(helm-lint): Add TLSClientConfig * fix(helm-lint): Add HTTP/HTTPS URL support for json schema references - Update to version 3.18.5: * fix Chart.yaml handling 7799b48 (Matt Farina) * Handle messy index files dd8502f (Matt Farina) * json schema fix cb8595b (Robert Sirchia) - Fix shell completion dependencies * Add BuildRequires to prevent inclusion of folders owned by shells. * Add Requires because installing completions without appropriate shell is questionable. - Fix zsh completion location
Patchnames: SUSE-SL-Micro-6.2-360
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-47911
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2025-58190
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 5 products, the same list as for CVE-2025-47911
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for helm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for helm fixes the following issues:\n\n- Update to version 3.19.1:\n  * CVE-2025-47911: golang.org/x/net/html: Fixed various algorithms with\n    quadratic complexity when parsing HTML documents (bsc#1251442)\n  * CVE-2025-58190: golang.org/x/net/html: Fixed xcessive memory\n    consumption by `html.ParseFragment` when processing specially\n    crafted input (bsc#1251649)\n  * jsonschema: warn and ignore unresolved URN $ref to match\n    v3.18.4\n  * Avoid \"panic: interface conversion: interface {} is nil\"\n  * Fix `helm pull` untar dir check with repo urls\n  * Fix deprecation warning\n  * Add timeout flag to repo add and update flags\n\n- Update to version 3.19.0:\n  * bump version to v3.19.0\n  * fix: use username and password if provided\n  * fix(helm-lint): fmt\n  * fix(helm-lint): Add TLSClientConfig\n  * fix(helm-lint): Add HTTP/HTTPS URL support for json schema references\n  * chore(deps): bump the k8s-io group with 7 updates\n  * fix: go mod tidy for v3\n  * fix Chart.yaml handling\n  * Handle messy index files\n  * json schema fix\n  * fix: k8s version parsing to match original\n  * Do not explicitly set SNI in HTTPGetter\n  * Disabling linter due to unknown issue\n  * Updating link handling\n  * fix: user username password for login\n  * Update pkg/registry/transport.go\n  * fix: add debug logging to oci transport\n  * fix: legacy docker support broken for login\n  * fix: plugin installer test with no Internet\n  * Handle an empty registry config file.\n  * Prevent fetching newReference again as we have in calling method\n  * Prevent failure when resolving version tags in oras memory store\n  * fix(client): skipnode utilization for PreCopy\n  * test: Skip instead of returning early. looks more intentional\n  * test: tests repo stripping functionality\n  * test: include tests for Login based on different protocol prefixes\n  * fix(client): layers now returns manifest - remove duplicate from descriptors\n  * fix(client): return nil on non-allowed media types\n  * Fix 3.18.0 regression: registry login with scheme\n  * Update pkg/plugin/plugin.go\n  * Wait for Helm v4 before raising when platformCommand and Command are set\n  * Revert \"fix (helm) : toToml` renders int as float [ backport to v3 ]\"\n  * build(deps): bump the k8s-io group with 7 updates\n  * chore: update generalization warning message\n  * fix: move warning to top of block\n  * fix: govulncheck workflow\n  * fix: replace fmt warning with slog\n  * fix: add warning when ignore repo flag\n  * feat: add httproute from gateway-api to create chart template\n\n- Update to version 3.18.6:\n  * fix(helm-lint): fmt\n  * fix(helm-lint): Add TLSClientConfig\n  * fix(helm-lint): Add HTTP/HTTPS URL support for json schema\n    references\n\n- Update to version 3.18.5:\n  * fix Chart.yaml handling 7799b48 (Matt Farina)\n  * Handle messy index files dd8502f (Matt Farina)\n  * json schema fix cb8595b (Robert Sirchia)\n\n- Fix shell completion dependencies\n  * Add BuildRequires to prevent inclusion of folders owned by shells.\n  * Add Requires because installing completions without appropriate\n    shell is questionable.\n\n- Fix zsh completion location\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-360",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20685-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20685-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620685-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20685-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024734.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251442",
        "url": "https://bugzilla.suse.com/1251442"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251649",
        "url": "https://bugzilla.suse.com/1251649"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      }
    ],
    "title": "Security update for helm",
    "tracking": {
      "current_release_date": "2026-09-16T19:34:23Z",
      "generator": {
        "date": "2026-03-05T14:28:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20685-1",
      "initial_release_date": "2026-03-05T14:28:21Z",
      "revision_history": [
        {
          "date": "2026-03-05T14:28:21Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:43:42Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T19:34:23Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.19.1-160000.1.1.aarch64",
                "product": {
                  "name": "helm-3.19.1-160000.1.1.aarch64",
                  "product_id": "helm-3.19.1-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:3.19.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@3.19.1-160000.1.1?arch=aarch64\u0026upstream=helm-3.19.1-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.19.1-160000.1.1.noarch",
                "product": {
                  "name": "helm-bash-completion-3.19.1-160000.1.1.noarch",
                  "product_id": "helm-bash-completion-3.19.1-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:3.19.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm-bash-completion@3.19.1-160000.1.1?arch=noarch\u0026upstream=helm-3.19.1-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.19.1-160000.1.1.ppc64le",
                "product": {
                  "name": "helm-3.19.1-160000.1.1.ppc64le",
                  "product_id": "helm-3.19.1-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:3.19.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@3.19.1-160000.1.1?arch=ppc64le\u0026upstream=helm-3.19.1-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.19.1-160000.1.1.s390x",
                "product": {
                  "name": "helm-3.19.1-160000.1.1.s390x",
                  "product_id": "helm-3.19.1-160000.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:3.19.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@3.19.1-160000.1.1?arch=s390x\u0026upstream=helm-3.19.1-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.19.1-160000.1.1.x86_64",
                "product": {
                  "name": "helm-3.19.1-160000.1.1.x86_64",
                  "product_id": "helm-3.19.1-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:3.19.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@3.19.1-160000.1.1?arch=x86_64\u0026upstream=helm-3.19.1-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.19.1-160000.1.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64"
        },
        "product_reference": "helm-3.19.1-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.19.1-160000.1.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le"
        },
        "product_reference": "helm-3.19.1-160000.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.19.1-160000.1.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x"
        },
        "product_reference": "helm-3.19.1-160000.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.19.1-160000.1.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64"
        },
        "product_reference": "helm-3.19.1-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.19.1-160000.1.1.noarch as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
        },
        "product_reference": "helm-bash-completion-3.19.1-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64",
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le",
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x",
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64",
          "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-05T14:28:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64",
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le",
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x",
          "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64",
          "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.19.1-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.19.1-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-05T14:28:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.