GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2026:21461-1

Vulnerability from csaf_suse - Published: 2026-04-30 13:22 - Updated: 2026-09-16 09:03
Summary
Security update for helm
Severity
Moderate
Notes
Title of the patch: Security update for helm
Description of the patch: This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093). - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to expected output directory suffixed by the Chart's name (bsc#1261938). Other updates and bugfixes: - Version 3.20.1: - chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot]) - add image index test 90e1056 (Pedro Trres) - fix pulling charts from OCI indices 911f2e9 (Pedro Trres) - Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai) - Fix import 45c12f7 (Evans Mungai) - Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai) - Fix lint warning 09f5129 (Evans Mungai) - Preserve nil values in chart already 417deb2 (Evans Mungai) - fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai) - Version 3.20.0: - SDK: bump k8s API versions to v0.35.0 - v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564 - v3 backport: Bump Go version to v1.25 - bump version to v3.20 - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 - chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 - chore(deps): bump the k8s-io group with 7 updates - [dev-v3] Replace deprecated `NewSimpleClientset` - [dev-v3] Bump Go v1.25, `golangci-lint` v2 - chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0 - chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30 - fix(rollback): `errors.Is` instead of string comp - fix(uninstall): supersede deployed releases - Use latest patch release of Go in releases - chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 - chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0 - chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 - chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 - chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1 - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 - chore(deps): bump github.com/cyphar/filepath-securejoin - chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0 - chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 - Remove dev-v3 `helm-latest-version` publish - chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 1.7.28 to 1.7.29 - Revert "pkg/registry: Login option for passing TLS config in memory" - jsonschema: warn and ignore unresolved URN $ref to match v3.18.4 - Fix `helm pull` untar dir check with repo urls - chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 - chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 - chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0 - [backport] fix: get-helm-3 script use helm3-latest-version - pkg/registry: Login option for passing TLS config in memory - Fix deprecation warning - chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 - chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 - Avoid "panic: interface conversion: interface {} is nil" - bump version to v3.19.0 - chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 - fix: set repo authorizer in registry.Client.Resolve() - fix null merge - Add timeout flag to repo add and update flags - Version 3.19.5: - Fixed bug where removing subchart value via override resulted in warning #31118 - Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #12556 - fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals) - fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals) - fix null merge 578564e (Ben Foster) - Version 3.19.4: - Use latest patch release of Go in releases 7cfb6e4 (Matt Farina) - chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 59c951f (dependabot[bot]) - chore(deps): bump github.com/cyphar/filepath-securejoin d45f3f1 - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 d459544 (dependabot[bot]) - chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 becd387 (dependabot[bot]) - chore(deps): bump the k8s-io group with 7 updates edb1579 - Version 3.19.3: - Bump golang.org/x/crypto to v0.45.0 - Version 3.19.2: - [backport] fix: get-helm-3 script use helm3-latest-version 8766e71 (George Jenkins)
Patchnames: SUSE-SL-Micro-6.2-661
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-55199
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-35206
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
Recommended 5 products, the same list as for CVE-2025-55199
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for helm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for helm fixes the following issues:\n\nUpdate to version 3.20.2.\n\nSecurity issued fixed:\n\n- CVE-2025-55199: specially crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093).\n- CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output directory rather than to\n  expected output directory suffixed by the Chart\u0027s name (bsc#1261938).\n\nOther updates and bugfixes:\n\n- Version 3.20.1:\n  - chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot])\n  - add image index test 90e1056 (Pedro Trres)\n  - fix pulling charts from OCI indices 911f2e9 (Pedro Trres)\n  - Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai)\n  - Fix import 45c12f7 (Evans Mungai)\n  - Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai)\n  - Fix lint warning 09f5129 (Evans Mungai)\n  - Preserve nil values in chart already 417deb2 (Evans Mungai)\n  - fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai)\n- Version 3.20.0:\n  - SDK: bump k8s API versions to v0.35.0\n  - v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564\n  - v3 backport: Bump Go version to v1.25\n  - bump version to v3.20\n  - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0\n  - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0\n  - chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0\n  - chore(deps): bump the k8s-io group with 7 updates\n  - [dev-v3] Replace deprecated `NewSimpleClientset`\n  - [dev-v3] Bump Go v1.25, `golangci-lint` v2\n  - chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0\n  - chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30\n  - fix(rollback): `errors.Is` instead of string comp\n  - fix(uninstall): supersede deployed releases\n  - Use latest patch release of Go in releases\n  - chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0\n  - chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0\n  - chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0\n  - chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2\n  - chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1\n  - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0\n  - chore(deps): bump github.com/cyphar/filepath-securejoin\n  - chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0\n  - chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0\n  - Remove dev-v3 `helm-latest-version` publish\n  - chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 1.7.28 to 1.7.29\n  - Revert \"pkg/registry: Login option for passing TLS config in memory\"\n  - jsonschema: warn and ignore unresolved URN $ref to match v3.18.4\n  - Fix `helm pull` untar dir check with repo urls\n  - chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0\n  - chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0\n  - chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0\n  - [backport] fix: get-helm-3 script use helm3-latest-version\n  - pkg/registry: Login option for passing TLS config in memory\n  - Fix deprecation warning\n  - chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0\n  - chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0\n  - Avoid \"panic: interface conversion: interface {} is nil\"\n  - bump version to v3.19.0\n  - chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10\n  - fix: set repo authorizer in registry.Client.Resolve()\n  - fix null merge\n  - Add timeout flag to repo add and update flags\n- Version 3.19.5:\n  - Fixed bug where removing subchart value via override resulted in warning #31118\n  - Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #12556\n  - fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals)\n  - fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals)\n  - fix null merge 578564e (Ben Foster)\n- Version 3.19.4:\n  - Use latest patch release of Go in releases 7cfb6e4 (Matt Farina)\n  - chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 59c951f (dependabot[bot])\n  - chore(deps): bump github.com/cyphar/filepath-securejoin d45f3f1\n  - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 d459544 (dependabot[bot])\n  - chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 becd387 (dependabot[bot])\n  - chore(deps): bump the k8s-io group with 7 updates edb1579\n- Version 3.19.3:\n  - Bump golang.org/x/crypto to v0.45.0\n- Version 3.19.2:\n  - [backport] fix: get-helm-3 script use helm3-latest-version 8766e71 (George Jenkins)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-661",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21461-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:21461-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621461-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:21461-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/025795.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248093",
        "url": "https://bugzilla.suse.com/1248093"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261938",
        "url": "https://bugzilla.suse.com/1261938"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55199 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55199/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-35206 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-35206/"
      }
    ],
    "title": "Security update for helm",
    "tracking": {
      "current_release_date": "2026-09-16T09:03:04Z",
      "generator": {
        "date": "2026-04-30T13:22:50Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:21461-1",
      "initial_release_date": "2026-04-30T13:22:50Z",
      "revision_history": [
        {
          "date": "2026-04-30T13:22:50Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T09:03:04Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.20.2-160000.1.1.aarch64",
                "product": {
                  "name": "helm-3.20.2-160000.1.1.aarch64",
                  "product_id": "helm-3.20.2-160000.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.20.2-160000.1.1.noarch",
                "product": {
                  "name": "helm-bash-completion-3.20.2-160000.1.1.noarch",
                  "product_id": "helm-bash-completion-3.20.2-160000.1.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.20.2-160000.1.1.ppc64le",
                "product": {
                  "name": "helm-3.20.2-160000.1.1.ppc64le",
                  "product_id": "helm-3.20.2-160000.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.20.2-160000.1.1.s390x",
                "product": {
                  "name": "helm-3.20.2-160000.1.1.s390x",
                  "product_id": "helm-3.20.2-160000.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.20.2-160000.1.1.x86_64",
                "product": {
                  "name": "helm-3.20.2-160000.1.1.x86_64",
                  "product_id": "helm-3.20.2-160000.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.20.2-160000.1.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64"
        },
        "product_reference": "helm-3.20.2-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.20.2-160000.1.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le"
        },
        "product_reference": "helm-3.20.2-160000.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.20.2-160000.1.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x"
        },
        "product_reference": "helm-3.20.2-160000.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.20.2-160000.1.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64"
        },
        "product_reference": "helm-3.20.2-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.20.2-160000.1.1.noarch as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
        },
        "product_reference": "helm-bash-completion-3.20.2-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-55199",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55199"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64",
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le",
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x",
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64",
          "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55199",
          "url": "https://www.suse.com/security/cve/CVE-2025-55199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248093 for CVE-2025-55199",
          "url": "https://bugzilla.suse.com/1248093"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-30T13:22:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-55199"
    },
    {
      "cve": "CVE-2026-35206",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-35206"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. In Helm versions \u003c=3.20.1 and \u003c=4.1.3, a specially crafted Chart will cause helm pull --untar  [chart URL | repo/chartname] to write the Chart\u0027s contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart\u0027s name. This vulnerability is fixed in 3.20.2 and 4.1.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64",
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le",
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x",
          "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64",
          "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-35206",
          "url": "https://www.suse.com/security/cve/CVE-2026-35206"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261938 for CVE-2026-35206",
          "url": "https://bugzilla.suse.com/1261938"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.aarch64",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.ppc64le",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.s390x",
            "SUSE Linux Micro 6.2:helm-3.20.2-160000.1.1.x86_64",
            "SUSE Linux Micro 6.2:helm-bash-completion-3.20.2-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-30T13:22:50Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-35206"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.