Security update for helm
This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093). - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938). Other updates and bugfixes: - Version 3.20.1: - chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot]) - add image index test 90e1056 (Pedro Torres) - fix pulling charts from OCI indices 911f2e9 (Pedro Torres) - Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai) - Fix import 45c12f7 (Evans Mungai) - Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai) - Fix lint warning 09f5129 (Evans Mungai) - Preserve nil values in chart already 417deb2 (Evans Mungai) - fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai) - Version 3.20.0: - SDK: bump k8s API versions to v0.35.0 - v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564 - v3 backport: Bump Go version to v1.25 - bump version to v3.20 - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 - chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 - chore(deps): bump the k8s-io group with 7 updates - [dev-v3] Replace de
SUSE-SU-2026:21434-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:21434-1
helm
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.20.2-160000.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
helm
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.20.2-160000.1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.20.2-160000.1.1"
}
]
}
],
"package": {
"name": "helm",
"purl": "pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"helm": "3.20.2-160000.1.1",
"helm-zsh-completion": "3.20.2-160000.1.1",
"helm-bash-completion": "3.20.2-160000.1.1",
"helm-fish-completion": "3.20.2-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.20.2-160000.1.1"
}
]
}
],
"package": {
"name": "helm",
"purl": "pkg:rpm/suse/helm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21434-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"helm": "3.20.2-160000.1.1",
"helm-zsh-completion": "3.20.2-160000.1.1",
"helm-bash-completion": "3.20.2-160000.1.1",
"helm-fish-completion": "3.20.2-160000.1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #17554 · Revision 1
- Added to Heist Feed
- Publisher date