Helm Stack Overflow Vulnerability via Deeply Nested JSON Schema References

A stack overflow vulnerability has been identified in Helm, a package manager for Kubernetes charts. This issue arises from a JSON Schema file within a chart that can be crafted with a deeply nested chain of references. Such a configuration leads to parser recursion, potentially exceeding the stack size limit and causing a stack overflow. The vulnerability affects Helm versions prior to 3.17.3.

Impact

Exploitation of this vulnerability causes a stack overflow, which can lead to a denial-of-service condition by crashing the application.

Remediation

Users can upgrade to Helm version 3.17.3 or later to address this vulnerability. Additionally, ensure that the JSON Schema within any charts loaded by Helm does not contain a large number of nested references, especially in files larger than 10 MiB.