{"id":"CVE-2022-23524","title":"helm: Denial of service through string value parsing (CVE-2022-23524)","summary":"A flaw was found in Helm, a tool for managing Charts, a pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption. Input to functions in the _strvals_ package could cause a stack overflo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-400","vendor":"Red Hat","product":"RHACS 4.0 for RHEL 8","affected":["cert_manager_operator_for_red_hat_openshift","openshift_developer_tools_and_services","openshift_serverless","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 3","openshift_container_platform 4","openshift_container_storage 4","rhacs_4_0_for_rhel 8","openshift_container_platform 4.12"],"patched":["rhacs_4_0_for_rhel 8","openshift_container_platform 4.12"],"published":"2022-12-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T14:34:53+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23524.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23524.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-23524"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2154200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23524"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23524"},{"url":"https://github.com/helm/helm/security/advisories/GHSA-6rx9-889q-vv2r"},{"url":"https://access.redhat.com/errata/RHEA-2023:2102"},{"url":"https://access.redhat.com/errata/RHSA-2023:1646"},{"url":"https://github.com/helm/helm/commit/3636f6824757ff734cb265b8770efe48c1fb3737"},{"url":"https://github.com/helm/helm"},{"url":"https://pkg.go.dev/vuln/GO-2022-1167"}],"tags":["csaf","vex","red-hat","osv","go","score-dispute"],"epss":0.0076,"epssPercentile":0.53347,"aliases":["GHSA-6rx9-889q-vv2r","BIT-helm-2022-23524","GO-2022-1167"],"ecosystem":"go","scores":{"vendor":7.5,"osv":5.3},"ingestedAt":"2026-09-12T03:13:01.760Z","slug":"CVE-2022-23524","body":"## Overview\n\nA flaw was found in Helm, a tool for managing Charts, a pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption. Input to functions in the _strvals_ package could cause a stack overflow that is unrecoverable by Go. Applications that use functions from the _strvals_ package in Helm SDK may result in a denial of service.\n\n## Vendor advisories\n\n- **RHEA-2023:2102** · Red Hat · fixed in: RHACS 4.0 for RHEL 8 · released 2023-05-03 · [advisory](https://access.redhat.com/errata/RHEA-2023:2102)\n- **RHSA-2023:1646** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2023-04-11 · [advisory](https://access.redhat.com/errata/RHSA-2023:1646)\n- **Red Hat VEX** · Moderate · affected: cert-manager Operator for Red Hat OpenShift, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 3, … · no fix planned: Red Hat Openshift Container Storage 4, cert-manager Operator for Red Hat OpenShift, OpenShift Developer Tools and Services, OpenShift Serverless, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23524.json)\n\n**helm: Denial of service through string value parsing** — rated Moderate by Red Hat. Released 2022-12-15, updated 2026-09-17.\n\nAffected:\n\n- cert-manager Operator for Red Hat OpenShift\n- OpenShift Developer Tools and Services\n- OpenShift Serverless\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 3\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Container Storage 4\n\nFixed:\n\n- RHACS 4.0 for RHEL 8\n- Red Hat OpenShift Container Platform 4.12\n\nNo fix planned:\n\n- Red Hat Openshift Container Storage 4\n- cert-manager Operator for Red Hat OpenShift\n- OpenShift Developer Tools and Services\n- OpenShift Serverless\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 4\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Security 3\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 4.12\n- Cryostat 2\n- Red Hat Openshift Data Foundation 4\n\n## Remediation\n\nTo take advantage of the new features, bug fixes, and enhancements in RHACS 4.0, you are advised to upgrade to RHACS 4.0. https://access.redhat.com/errata/RHEA-2023:2102\nFor OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html https://access.redhat.com/errata/RHSA-2023:1646\n\nWorkarounds / mitigations:\n\n- SDK users can validate strings supplied by users that won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.\n\n## Package advisory (CVE-2022-23524)\n\nAffected packages:\n\n- `helm.sh/helm/v3 < 3.10.3`\n\nPatched in:\n\n- `helm.sh/helm/v3 3.10.3`\n\nSource: https://osv.dev/vulnerability/GHSA-6rx9-889q-vv2r","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":206306,"id":"CVE-2022-23524","ts":1789663197221,"field":"cvss","old":"5.3","new":"7.5"},{"seq":206305,"id":"CVE-2022-23524","ts":1789663197221,"field":"severity","old":"medium","new":"high"}]}