---
id: CVE-2025-32387
aliases:
  - GHSA-5xqw-8hwv-wg92
  - BIT-helm-2025-32387
  - GO-2025-3602
title: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
summary: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: helm
product: helm.sh/helm/v3
ecosystem: go
affected:
  - helm.sh/helm/v3 < 3.17.3
patched:
  - helm.sh/helm/v3 3.17.3
published: '2025-04-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:57.093727559Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5xqw-8hwv-wg92'
references:
  - url: 'https://github.com/helm/helm/security/advisories/GHSA-5xqw-8hwv-wg92'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-32387'
  - url: >-
      https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7
  - url: 'https://github.com/helm/helm'
tags:
  - osv
  - go
epss: 0.00483
epssPercentile: 0.38919
ingestedAt: '2026-09-12T03:13:01.757Z'
---

## Overview

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.

### Impact
A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. 

### Patches
This issue has been resolved in Helm v3.17.3.

### Workarounds
Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.

### For more information
Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits
Disclosed by Jakub Ciolek at AlphaSense.

## Affected packages

- `helm.sh/helm/v3 < 3.17.3`

## Remediation

Upgrade to a patched release:

- `helm.sh/helm/v3 3.17.3`