Helm

Orchestration · products/helm.yaml · RSS

Latest 4.3.1 Oct 15, 2026

Recent releases

4.3.1 Oct 15, 2026 Release notes ↗ 6fix

4.3.0 Sep 9, 2026 → 4.3.1 Release notes ↗ 15fix19feature6breaking

breakingfix (internal/plugin): remove zero-width spaces from plugin name comment

breakingRemove deprecated internal/chart/v3/ code (#32365) 4dfbaa40c6cd67e1df345889113a7879ec66136c (George Jenkins)

breakingRemoved extra space in rollback-with-description.txt b177a8e9060720e91c402cdba2224c6d58789fa3 (MrJack)

4.2.4 Aug 13, 2026 → 4.3.1 Release notes ↗ 27fix1breaking1feature

breakingremove freeport dependency 9fbd190c30addb4786e4fe930a0fe98bf354116a (kimsungmin1)

4.2.3 Jul 9, 2026 → 4.3.1 Release notes ↗ 1fix

4.2.2 Jun 17, 2026 → 4.3.1 Release notes ↗ 1fix

4.2.1 Jun 12, 2026 → 4.3.1 Release notes ↗ 15fix1feature

4.2.0 May 14, 2026 → 4.3.1 Release notes ↗ 26fix9feature1deprecated4breaking

breakingremove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe)

breakingpkg/kube: remove legacy import comments d7cdc9e8fb20c42d19a2371f37ee719be6be6b94 (abhay1999)

breakingRemove legacy sync-repo.sh script 97fd00786f16ebc3b68164bff7133592f19f70b6 (Jeevan Yewale)

4.1.4 Apr 9, 2026 → 4.3.1 Release notes ↗ 6fix3security

securityGHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

securityGHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install

securityGHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

4.1.3 Mar 11, 2026 → 4.3.1 Release notes ↗ 33fix1deprecated1breaking3feature

breakingRemove refactorring changes from coalesce_test.go c3c57dba9878074a7642f2cdf583e809bba7f96e (Evans Mungai)

4.1.1 Feb 9, 2026 → 4.3.1 Release notes ↗ 7fix1feature

4.1.0 Jan 21, 2026 → 4.3.1 Release notes ↗ 23fix13feature2breaking1deprecated1security

breakingFixed regression where vendor-specific suffixes were stripped from .Capabilities.KubeVersion.GitVersion, breaking charts that detect managed Kubernetes platforms #31528

securityRun the vulnerability check on PR that change the file 24a82589f8ee9f8f385c63b6c68dabdf19109da7 (Matt Farina)

breakingRemove two redundant if-checks. 380abe2b1643e1a8eec9cd575d1d5c0521cf1c31 (Mads Jensen)

4.0.5 Jan 14, 2026 → 4.3.1 Release notes ↗ 18fix1breaking2feature

breakingFixed rollback error when a manifest is removed in a failed upgrade #13437

4.0.4 Dec 13, 2025 → 4.3.1 Release notes ↗ 1fix

4.0.2 Dec 10, 2025 → 4.3.1 Release notes ↗ 4fix

4.0.1 Nov 24, 2025 → 4.3.1 Release notes ↗ 6fix

Security advisories

4.8 CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

8.4 CVE-2026-35204 Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

9.3 CVE-2026-35205 Plugin verification fails open when `.prov` is missing, allowing unsigned plugin install

6.5 CVE-2025-55198 Incorrect YAML Content Leads To Panic

6.5 CVE-2025-55199 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

8.5 CVE-2025-53547 Chart Dependency Updating With Malicious Chart.yaml Content And Symlink

6.5 CVE-2025-32386 Specially Crafted Chart Archive Can Cause Out Of Memory Termination

6.5 CVE-2025-32387 Specially Crafted JSON Schema Can Cause Stack Overflow

medium CVE-2024-26147 Missing YAML Content Leads To Panic

medium CVE-2024-25620 Dependency management path traversal

low CVE-2023-25165 getHostByName Function Information Disclosure

medium CVE-2022-23524 Denial of service through string value parsing

medium CVE-2022-23525 Denial of service through through repository index file

medium CVE-2022-23526 Denial of service through schema file

medium CVE-2022-36055 Denial of service through string value parsing

medium CVE-2021-32690 Repository credentials passed to alternate domain

low CVE-2021-21303 Unsanitized data displayed directly to user's terminal

low CVE-2020-15187 plugin.yaml file allows for duplicate entries

low CVE-2020-15186 Sanitizing plugin names

low CVE-2020-15185 Repository index file allows for duplicates of the same chart entry

Recent releases

Security advisories

Sources