---
id: CVE-2022-23524
title: 'helm: Denial of service through string value parsing (CVE-2022-23524)'
summary: >-
  A flaw was found in Helm, a tool for managing Charts, a pre-configured
  Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled
  Resource Consumption. Input to functions in the _strvals_ package could cause
  a stack overflo…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-400
vendor: Red Hat
product: RHACS 4.0 for RHEL 8
affected:
  - cert_manager_operator_for_red_hat_openshift
  - openshift_developer_tools_and_services
  - openshift_serverless
  - 3scale_api_management_platform 2
  - advanced_cluster_management_for_kubernetes 2
  - advanced_cluster_security 3
  - openshift_container_platform 4
  - openshift_container_storage 4
  - rhacs_4_0_for_rhel 8
  - openshift_container_platform 4.12
patched:
  - rhacs_4_0_for_rhel 8
  - openshift_container_platform 4.12
published: '2022-12-15'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T14:34:53+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23524.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23524.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-23524'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2154200'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-23524'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23524'
  - url: 'https://github.com/helm/helm/security/advisories/GHSA-6rx9-889q-vv2r'
  - url: 'https://access.redhat.com/errata/RHEA-2023:2102'
  - url: 'https://access.redhat.com/errata/RHSA-2023:1646'
  - url: >-
      https://github.com/helm/helm/commit/3636f6824757ff734cb265b8770efe48c1fb3737
  - url: 'https://github.com/helm/helm'
  - url: 'https://pkg.go.dev/vuln/GO-2022-1167'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
  - score-dispute
epss: 0.0076
epssPercentile: 0.53347
aliases:
  - GHSA-6rx9-889q-vv2r
  - BIT-helm-2022-23524
  - GO-2022-1167
ecosystem: go
scores:
  vendor: 7.5
  osv: 5.3
ingestedAt: '2026-09-12T03:13:01.760Z'
---

## Overview

A flaw was found in Helm, a tool for managing Charts, a pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption. Input to functions in the _strvals_ package could cause a stack overflow that is unrecoverable by Go. Applications that use functions from the _strvals_ package in Helm SDK may result in a denial of service.

## Vendor advisories

- **RHEA-2023:2102** · Red Hat · fixed in: RHACS 4.0 for RHEL 8 · released 2023-05-03 · [advisory](https://access.redhat.com/errata/RHEA-2023:2102)
- **RHSA-2023:1646** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2023-04-11 · [advisory](https://access.redhat.com/errata/RHSA-2023:1646)
- **Red Hat VEX** · Moderate · affected: cert-manager Operator for Red Hat OpenShift, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 3, … · no fix planned: Red Hat Openshift Container Storage 4, cert-manager Operator for Red Hat OpenShift, OpenShift Developer Tools and Services, OpenShift Serverless, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-23524.json)

**helm: Denial of service through string value parsing** — rated Moderate by Red Hat. Released 2022-12-15, updated 2026-09-17.

Affected:

- cert-manager Operator for Red Hat OpenShift
- OpenShift Developer Tools and Services
- OpenShift Serverless
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Container Storage 4

Fixed:

- RHACS 4.0 for RHEL 8
- Red Hat OpenShift Container Platform 4.12

No fix planned:

- Red Hat Openshift Container Storage 4
- cert-manager Operator for Red Hat OpenShift
- OpenShift Developer Tools and Services
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Security 3

Not affected:

- Red Hat OpenShift Container Platform 4.12
- Cryostat 2
- Red Hat Openshift Data Foundation 4

## Remediation

To take advantage of the new features, bug fixes, and enhancements in RHACS 4.0, you are advised to upgrade to RHACS 4.0. https://access.redhat.com/errata/RHEA-2023:2102
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html https://access.redhat.com/errata/RHSA-2023:1646

Workarounds / mitigations:

- SDK users can validate strings supplied by users that won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

## Package advisory (CVE-2022-23524)

Affected packages:

- `helm.sh/helm/v3 < 3.10.3`

Patched in:

- `helm.sh/helm/v3 3.10.3`

Source: https://osv.dev/vulnerability/GHSA-6rx9-889q-vv2r