{"schema_version":"2","view":"grouped","data":[{"id":70957,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/advisories/advisory%3A03237c51-9d40-4d67-be46-7406c5c2b0b1","group":{"id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","revision":1,"primary_event_id":71328,"change":"published","superseded_by":[],"changed":{"id":71328,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/events/71328"},"members":[{"id":71328,"cve_ids":["CVE-2026-85731","CVE-2026-85732"],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.0: * chore(deps): bump the k8s-io group across 1 directory with 6 updates * bump version to 3.22 (#32606) * fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) * chore(deps): bump the k8s-io group with 7 updates (#32573) * chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) * [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) * fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) * chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 * fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 * chore(deps): bump the k8s-io group with 7 updates * chore(deps): bump github/codeql-action/upload-sarif (#32449) * chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 * chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 * chore(d","evidence":"osv:SUSE-SU-2026:4417-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.22.0-150000.1.99.1","evidence":"/affected/12/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4417-1","aliases":["SUSE-SU-2026:4417-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Micro%205.5","ecosystem":"SUSE:Linux Enterprise Micro 5.5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm-fish-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-150000.1.99.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4417-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.22.0-150000.1.99.1","helm-zsh-completion":"3.22.0-150000.1.99.1","helm-bash-completion":"3.22.0-150000.1.99.1"}]}}],"modified":"2026-10-02T18:30:38.457958645Z","provider":"osv","upstream":["CVE-2026-85731","CVE-2026-85732"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264417-1/","https://bugzilla.suse.com/1281104","https://bugzilla.suse.com/1281112","https://www.suse.com/security/cve/CVE-2026-85731","https://www.suse.com/security/cve/CVE-2026-85732"]},"related_cves":[{"value":"CVE-2026-85731","evidence":"/upstream"},{"value":"CVE-2026-85732","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:03237c51-9d40-4d67-be46-7406c5c2b0b1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85731","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"oras.land/oras-go/v2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m37j-52j7-pjw7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4417-1","advisory_id":"03237c51-9d40-4d67-be46-7406c5c2b0b1","event_types":["advisory"],"published_at":"2026-10-25T22:45:36.224698+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T09:20:18+00:00","detail_url":"/events/71328"}]}},{"id":31076,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688).","evidence":"osv:SUSE-SU-2026:23730-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-slfo.1.1_3.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23730-1","aliases":["SUSE-SU-2026:23730-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-slfo.1.1_3.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.1","ecosystem":"SUSE:Linux Micro 6.1"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23730-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-slfo.1.1_3.1","helm-bash-completion":"3.21.3-slfo.1.1_3.1"}]}}],"modified":"2026-09-29T18:23:13.495337966Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623730-1/","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:477fb5b0-7f65-4c83-a586-4210e095ffea","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23730-1","advisory_id":"477fb5b0-7f65-4c83-a586-4210e095ffea","event_types":["advisory"],"published_at":"2026-10-25T08:22:30.710728+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-09T11:53:40+00:00","detail_url":"/advisories/advisory%3A477fb5b0-7f65-4c83-a586-4210e095ffea","group":{"id":"advisory:477fb5b0-7f65-4c83-a586-4210e095ffea","revision":1,"primary_event_id":30823,"change":"published","superseded_by":[],"changed":{"id":30823,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688).","evidence":"osv:SUSE-SU-2026:23730-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-slfo.1.1_3.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23730-1","aliases":["SUSE-SU-2026:23730-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-slfo.1.1_3.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.1","ecosystem":"SUSE:Linux Micro 6.1"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23730-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-slfo.1.1_3.1","helm-bash-completion":"3.21.3-slfo.1.1_3.1"}]}}],"modified":"2026-09-29T18:23:13.495337966Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623730-1/","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:477fb5b0-7f65-4c83-a586-4210e095ffea","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23730-1","advisory_id":"477fb5b0-7f65-4c83-a586-4210e095ffea","event_types":["advisory"],"published_at":"2026-10-25T08:22:30.710728+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-09T11:53:40+00:00","detail_url":"/events/30823"},"members":[{"id":30823,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688).","evidence":"osv:SUSE-SU-2026:23730-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-slfo.1.1_3.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23730-1","aliases":["SUSE-SU-2026:23730-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-slfo.1.1_3.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.1","ecosystem":"SUSE:Linux Micro 6.1"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23730-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-slfo.1.1_3.1","helm-bash-completion":"3.21.3-slfo.1.1_3.1"}]}}],"modified":"2026-09-29T18:23:13.495337966Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623730-1/","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:477fb5b0-7f65-4c83-a586-4210e095ffea","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23730-1","advisory_id":"477fb5b0-7f65-4c83-a586-4210e095ffea","event_types":["advisory"],"published_at":"2026-10-25T08:22:30.710728+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-09T11:53:40+00:00","detail_url":"/events/30823"}]}},{"id":31060,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402). - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).","evidence":"osv:SUSE-SU-2026:23688-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-160000.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-160000.2.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23688-1","aliases":["SUSE-SU-2026:23688-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0","ecosystem":"SUSE:Linux Enterprise Server 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23688-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-160000.2.1","helm-zsh-completion":"3.21.3-160000.2.1","helm-bash-completion":"3.21.3-160000.2.1","helm-fish-completion":"3.21.3-160000.2.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23688-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-160000.2.1","helm-zsh-completion":"3.21.3-160000.2.1","helm-bash-completion":"3.21.3-160000.2.1","helm-fish-completion":"3.21.3-160000.2.1"}]}}],"modified":"2026-09-29T18:23:12.089974044Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623688-1/","https://bugzilla.suse.com/1270127","https://bugzilla.suse.com/1271660","https://bugzilla.suse.com/1272402","https://bugzilla.suse.com/1276514","https://bugzilla.suse.com/1276644","https://bugzilla.suse.com/1277949","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-37236","https://www.suse.com/security/cve/CVE-2026-41178","https://www.suse.com/security/cve/CVE-2026-48978","https://www.suse.com/security/cve/CVE-2026-50151","https://www.suse.com/security/cve/CVE-2026-63308","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fc878d69-8d41-4b47-90f1-3c5e0572448a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23688-1","advisory_id":"fc878d69-8d41-4b47-90f1-3c5e0572448a","event_types":["advisory"],"published_at":"2026-10-25T08:22:19.462886+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-08T14:29:35+00:00","detail_url":"/advisories/advisory%3Afc878d69-8d41-4b47-90f1-3c5e0572448a","group":{"id":"advisory:fc878d69-8d41-4b47-90f1-3c5e0572448a","revision":1,"primary_event_id":30807,"change":"published","superseded_by":[],"changed":{"id":30807,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402). - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).","evidence":"osv:SUSE-SU-2026:23688-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-160000.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-160000.2.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23688-1","aliases":["SUSE-SU-2026:23688-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0","ecosystem":"SUSE:Linux Enterprise Server 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23688-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-160000.2.1","helm-zsh-completion":"3.21.3-160000.2.1","helm-bash-completion":"3.21.3-160000.2.1","helm-fish-completion":"3.21.3-160000.2.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23688-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-160000.2.1","helm-zsh-completion":"3.21.3-160000.2.1","helm-bash-completion":"3.21.3-160000.2.1","helm-fish-completion":"3.21.3-160000.2.1"}]}}],"modified":"2026-09-29T18:23:12.089974044Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623688-1/","https://bugzilla.suse.com/1270127","https://bugzilla.suse.com/1271660","https://bugzilla.suse.com/1272402","https://bugzilla.suse.com/1276514","https://bugzilla.suse.com/1276644","https://bugzilla.suse.com/1277949","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-37236","https://www.suse.com/security/cve/CVE-2026-41178","https://www.suse.com/security/cve/CVE-2026-48978","https://www.suse.com/security/cve/CVE-2026-50151","https://www.suse.com/security/cve/CVE-2026-63308","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fc878d69-8d41-4b47-90f1-3c5e0572448a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23688-1","advisory_id":"fc878d69-8d41-4b47-90f1-3c5e0572448a","event_types":["advisory"],"published_at":"2026-10-25T08:22:19.462886+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-08T14:29:35+00:00","detail_url":"/events/30807"},"members":[{"id":30807,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402). - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).","evidence":"osv:SUSE-SU-2026:23688-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-160000.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-160000.2.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23688-1","aliases":["SUSE-SU-2026:23688-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0","ecosystem":"SUSE:Linux Enterprise Server 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23688-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-160000.2.1","helm-zsh-completion":"3.21.3-160000.2.1","helm-bash-completion":"3.21.3-160000.2.1","helm-fish-completion":"3.21.3-160000.2.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23688-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-160000.2.1","helm-zsh-completion":"3.21.3-160000.2.1","helm-bash-completion":"3.21.3-160000.2.1","helm-fish-completion":"3.21.3-160000.2.1"}]}}],"modified":"2026-09-29T18:23:12.089974044Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623688-1/","https://bugzilla.suse.com/1270127","https://bugzilla.suse.com/1271660","https://bugzilla.suse.com/1272402","https://bugzilla.suse.com/1276514","https://bugzilla.suse.com/1276644","https://bugzilla.suse.com/1277949","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-37236","https://www.suse.com/security/cve/CVE-2026-41178","https://www.suse.com/security/cve/CVE-2026-48978","https://www.suse.com/security/cve/CVE-2026-50151","https://www.suse.com/security/cve/CVE-2026-63308","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fc878d69-8d41-4b47-90f1-3c5e0572448a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23688-1","advisory_id":"fc878d69-8d41-4b47-90f1-3c5e0572448a","event_types":["advisory"],"published_at":"2026-10-25T08:22:19.462886+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-08T14:29:35+00:00","detail_url":"/events/30807"}]}},{"id":31019,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688).","evidence":"osv:SUSE-SU-2026:23546-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-3.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23546-1","aliases":["SUSE-SU-2026:23546-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-3.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.0","ecosystem":"SUSE:Linux Micro 6.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23546-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-3.1","helm-bash-completion":"3.21.3-3.1"}]}}],"modified":"2026-09-29T18:23:08.335405944Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623546-1/","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e4a0321-adfd-490b-8cbb-4a42115baf3a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23546-1","advisory_id":"0e4a0321-adfd-490b-8cbb-4a42115baf3a","event_types":["advisory"],"published_at":"2026-10-25T08:21:12.726921+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-09T12:04:21+00:00","detail_url":"/advisories/advisory%3A0e4a0321-adfd-490b-8cbb-4a42115baf3a","group":{"id":"advisory:0e4a0321-adfd-490b-8cbb-4a42115baf3a","revision":1,"primary_event_id":30767,"change":"published","superseded_by":[],"changed":{"id":30767,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688).","evidence":"osv:SUSE-SU-2026:23546-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-3.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23546-1","aliases":["SUSE-SU-2026:23546-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-3.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.0","ecosystem":"SUSE:Linux Micro 6.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23546-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-3.1","helm-bash-completion":"3.21.3-3.1"}]}}],"modified":"2026-09-29T18:23:08.335405944Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623546-1/","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e4a0321-adfd-490b-8cbb-4a42115baf3a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23546-1","advisory_id":"0e4a0321-adfd-490b-8cbb-4a42115baf3a","event_types":["advisory"],"published_at":"2026-10-25T08:21:12.726921+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-09T12:04:21+00:00","detail_url":"/events/30767"},"members":[{"id":30767,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1278688).","evidence":"osv:SUSE-SU-2026:23546-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.21.3-3.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:23546-1","aliases":["SUSE-SU-2026:23546-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-3.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.0","ecosystem":"SUSE:Linux Micro 6.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23546-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.21.3-3.1","helm-bash-completion":"3.21.3-3.1"}]}}],"modified":"2026-09-29T18:23:08.335405944Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202623546-1/","https://bugzilla.suse.com/1278270","https://bugzilla.suse.com/1278273","https://bugzilla.suse.com/1278688","https://www.suse.com/security/cve/CVE-2026-84303","https://www.suse.com/security/cve/CVE-2026-84304","https://www.suse.com/security/cve/CVE-2026-84445"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e4a0321-adfd-490b-8cbb-4a42115baf3a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A23546-1","advisory_id":"0e4a0321-adfd-490b-8cbb-4a42115baf3a","event_types":["advisory"],"published_at":"2026-10-25T08:21:12.726921+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-09T12:04:21+00:00","detail_url":"/events/30767"}]}},{"id":19186,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-vwwm-w6jx-7g2q","summary":"MINI-vwwm-w6jx-7g2q","evidence":"osv:MINI-vwwm-w6jx-7g2q","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-vwwm-w6jx-7g2q","aliases":["MINI-vwwm-w6jx-7g2q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-r0"}]}],"package":{"name":"helm","purl":"pkg:apk/minimos/helm","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-vwwm-w6jx-7g2q.json"}}],"modified":"2026-09-26T16:00:10.673357439Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:093c1024-de05-476b-b96a-aaf72c2525a4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-vwwm-w6jx-7g2q","advisory_id":"093c1024-de05-476b-b96a-aaf72c2525a4","event_types":["advisory"],"published_at":"2026-10-25T02:03:02.17939+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T15:08:55+00:00","detail_url":"/advisories/advisory%3A093c1024-de05-476b-b96a-aaf72c2525a4","group":{"id":"advisory:093c1024-de05-476b-b96a-aaf72c2525a4","revision":1,"primary_event_id":19052,"change":"published","superseded_by":[],"changed":{"id":19052,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-vwwm-w6jx-7g2q","summary":"MINI-vwwm-w6jx-7g2q","evidence":"osv:MINI-vwwm-w6jx-7g2q","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-vwwm-w6jx-7g2q","aliases":["MINI-vwwm-w6jx-7g2q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-r0"}]}],"package":{"name":"helm","purl":"pkg:apk/minimos/helm","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-vwwm-w6jx-7g2q.json"}}],"modified":"2026-09-26T16:00:10.673357439Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:093c1024-de05-476b-b96a-aaf72c2525a4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-vwwm-w6jx-7g2q","advisory_id":"093c1024-de05-476b-b96a-aaf72c2525a4","event_types":["advisory"],"published_at":"2026-10-25T02:03:02.17939+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T15:08:55+00:00","detail_url":"/events/19052"},"members":[{"id":19052,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-vwwm-w6jx-7g2q","summary":"MINI-vwwm-w6jx-7g2q","evidence":"osv:MINI-vwwm-w6jx-7g2q","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-vwwm-w6jx-7g2q","aliases":["MINI-vwwm-w6jx-7g2q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-r0"}]}],"package":{"name":"helm","purl":"pkg:apk/minimos/helm","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-vwwm-w6jx-7g2q.json"}}],"modified":"2026-09-26T16:00:10.673357439Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:093c1024-de05-476b-b96a-aaf72c2525a4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-vwwm-w6jx-7g2q","advisory_id":"093c1024-de05-476b-b96a-aaf72c2525a4","event_types":["advisory"],"published_at":"2026-10-25T02:03:02.17939+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T15:08:55+00:00","detail_url":"/events/19052"}]}},{"id":17671,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093). - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938). Other updates and bugfixes: - Version 3.20.1: - chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot]) - add image index test 90e1056 (Pedro Torres) - fix pulling charts from OCI indices 911f2e9 (Pedro Torres) - Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai) - Fix import 45c12f7 (Evans Mungai) - Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai) - Fix lint warning 09f5129 (Evans Mungai) - Preserve nil values in chart already 417deb2 (Evans Mungai) - fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai) - Version 3.20.0: - SDK: bump k8s API versions to v0.35.0 - v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564 - v3 backport: Bump Go version to v1.25 - bump version to v3.20 - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 - chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 - chore(deps): bump the k8s-io group with 7 updates - [dev-v3] Replace de","evidence":"osv:SUSE-SU-2026:21434-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.20.2-160000.1.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.20.2-160000.1.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:21434-1","aliases":["SUSE-SU-2026:21434-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.1.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0","ecosystem":"SUSE:Linux Enterprise Server 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.20.2-160000.1.1","helm-zsh-completion":"3.20.2-160000.1.1","helm-bash-completion":"3.20.2-160000.1.1","helm-fish-completion":"3.20.2-160000.1.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.1.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.20.2-160000.1.1","helm-zsh-completion":"3.20.2-160000.1.1","helm-bash-completion":"3.20.2-160000.1.1","helm-fish-completion":"3.20.2-160000.1.1"}]}}],"modified":"2026-09-25T18:23:08.550960346Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202621434-1/","https://bugzilla.suse.com/1248093","https://bugzilla.suse.com/1261938","https://www.suse.com/security/cve/CVE-2025-55199","https://www.suse.com/security/cve/CVE-2026-35206"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7d1f53e-9a64-4543-ab88-0764f300b3c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A21434-1","advisory_id":"e7d1f53e-9a64-4543-ab88-0764f300b3c4","event_types":["advisory"],"published_at":"2026-10-25T01:35:12.760034+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T08:30:02+00:00","detail_url":"/advisories/advisory%3Ae7d1f53e-9a64-4543-ab88-0764f300b3c4","group":{"id":"advisory:e7d1f53e-9a64-4543-ab88-0764f300b3c4","revision":1,"primary_event_id":17554,"change":"published","superseded_by":[],"changed":{"id":17554,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093). - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938). Other updates and bugfixes: - Version 3.20.1: - chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot]) - add image index test 90e1056 (Pedro Torres) - fix pulling charts from OCI indices 911f2e9 (Pedro Torres) - Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai) - Fix import 45c12f7 (Evans Mungai) - Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai) - Fix lint warning 09f5129 (Evans Mungai) - Preserve nil values in chart already 417deb2 (Evans Mungai) - fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai) - Version 3.20.0: - SDK: bump k8s API versions to v0.35.0 - v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564 - v3 backport: Bump Go version to v1.25 - bump version to v3.20 - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 - chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 - chore(deps): bump the k8s-io group with 7 updates - [dev-v3] Replace de","evidence":"osv:SUSE-SU-2026:21434-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.20.2-160000.1.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.20.2-160000.1.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:21434-1","aliases":["SUSE-SU-2026:21434-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.1.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0","ecosystem":"SUSE:Linux Enterprise Server 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.20.2-160000.1.1","helm-zsh-completion":"3.20.2-160000.1.1","helm-bash-completion":"3.20.2-160000.1.1","helm-fish-completion":"3.20.2-160000.1.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.1.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.20.2-160000.1.1","helm-zsh-completion":"3.20.2-160000.1.1","helm-bash-completion":"3.20.2-160000.1.1","helm-fish-completion":"3.20.2-160000.1.1"}]}}],"modified":"2026-09-25T18:23:08.550960346Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202621434-1/","https://bugzilla.suse.com/1248093","https://bugzilla.suse.com/1261938","https://www.suse.com/security/cve/CVE-2025-55199","https://www.suse.com/security/cve/CVE-2026-35206"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7d1f53e-9a64-4543-ab88-0764f300b3c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A21434-1","advisory_id":"e7d1f53e-9a64-4543-ab88-0764f300b3c4","event_types":["advisory"],"published_at":"2026-10-25T01:35:12.760034+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T08:30:02+00:00","detail_url":"/events/17554"},"members":[{"id":17554,"cve_ids":[],"payload":{"kind":"advisory","title":"Security update for helm","summary":"This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093). - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938). Other updates and bugfixes: - Version 3.20.1: - chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot]) - add image index test 90e1056 (Pedro Torres) - fix pulling charts from OCI indices 911f2e9 (Pedro Torres) - Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai) - Fix import 45c12f7 (Evans Mungai) - Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai) - Fix lint warning 09f5129 (Evans Mungai) - Preserve nil values in chart already 417deb2 (Evans Mungai) - fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai) - Version 3.20.0: - SDK: bump k8s API versions to v0.35.0 - v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564 - v3 backport: Bump Go version to v1.25 - bump version to v3.20 - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 - chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 - chore(deps): bump the k8s-io group with 7 updates - [dev-v3] Replace de","evidence":"osv:SUSE-SU-2026:21434-1","products":[{"name":{"value":"helm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.20.2-160000.1.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"helm","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.20.2-160000.1.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:21434-1","aliases":["SUSE-SU-2026:21434-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.1.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0","ecosystem":"SUSE:Linux Enterprise Server 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.20.2-160000.1.1","helm-zsh-completion":"3.20.2-160000.1.1","helm-bash-completion":"3.20.2-160000.1.1","helm-fish-completion":"3.20.2-160000.1.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.1.1"}]}],"package":{"name":"helm","purl":"pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"},"ecosystem_specific":{"binaries":[{"helm":"3.20.2-160000.1.1","helm-zsh-completion":"3.20.2-160000.1.1","helm-bash-completion":"3.20.2-160000.1.1","helm-fish-completion":"3.20.2-160000.1.1"}]}}],"modified":"2026-09-25T18:23:08.550960346Z","provider":"osv","references":["https://www.suse.com/support/update/announcement/2026/suse-su-202621434-1/","https://bugzilla.suse.com/1248093","https://bugzilla.suse.com/1261938","https://www.suse.com/security/cve/CVE-2025-55199","https://www.suse.com/security/cve/CVE-2026-35206"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7d1f53e-9a64-4543-ab88-0764f300b3c4","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A21434-1","advisory_id":"e7d1f53e-9a64-4543-ab88-0764f300b3c4","event_types":["advisory"],"published_at":"2026-10-25T01:35:12.760034+00:00","technologies":["core-osv","helm"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T08:30:02+00:00","detail_url":"/events/17554"}]}}],"next_after":70957,"next_before":17671}