CVE-2026-33814VulnerabilityPublished 19 Oct 2026Updated 26 Oct 2026

SUSE · Security update for helm

Affects SUSESource GCVE Database

Mentioned vulnerabilities

Authoritative record:CVE-2026-33814· High 7.5

Not known to be exploited · CVSS 7.5 High · fixed in SUSE package updates : patch SUSE http2 soon.

Data as of 26 Oct 2026, 21:28 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 0.53.0, 1.26.3, 1.25.10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 7 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade golang.org/x/net/http2 to 0.53.0; net/http to 1.26.3 or 1.25.10.

Affected software

Product	Affected	Fixed in
golang.org/x/netgolang.org/x/net/http2	Affected <0.53.0	Fixed in 0.53.0
Go standard librarynet/http	Affected >=1.26.0-0 <1.26.3	Fixed in 1.26.3
Go standard librarynet/http	Affected <1.25.10	Fixed in 1.25.10
Gogolang.org/x/net/http2`pkg:golang/golang.org/x/net/http2`Other threats	Affected =0	Fixed in–
Gogolang.org/x/net/http2`pkg:golang/golang.org/x/net/http2`Other threats	Affected <0.53.0	Fixed in 0.53.0
Gonet/http`pkg:golang/net/http`Other threats	Affected <1.25.10 >=1.26.0-0 <1.26.3	Fixed in 1.25.10 1.26.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758). - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939). - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935). - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938). - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327). - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024). - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104). - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468). - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514). Changes for helm: - update to 4.3.0: * feat: Add duration functions * feat(engine): add debug logging when lookup returns empty * feat: add ownership verification before deleting resources * feat: honor SOURCE_DATE_EPOCH for chart archives * feat(rollback): add --description flag to provide rollback reason * fix (internal/plugin): remove zero-width spaces from plugin name comment * fix(loader): do not drop values files ending at a 4096-byte boundary * fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings * fix(template): regression - route registry messages to stderr in template and show * refactor: lower resync period from one hour to 3 minutes * perf: enable concurrent status computation to prevent multi-minute delays * fix: Improve error reporting for helm template --debug with --show-only- #31185 * fix: fetch logs from all containers in test pods- #32099 * fix(provenance): check error return in Digest and encodeRelease- #32136 * fix panic on repeated IsReachable calls- #32184 * fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 * Fix missing conflict retry with server-side apply- #32088 * Properly format the extra field in gzipped packages- #31884 * Fix vanishing empty lines- #32327 * fix: pass registry client to downloader.Manager in upgrade- #32400 * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- #32450 * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe) * bump golang.org/x/text to v.0.40.0 * Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214 * Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925 * Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056 * Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757 * Fixed a race con

GCVE source: db.gcve.eu
Csaf Category: csaf_security_advisory
Csaf Version: 2.0
Publisher: SUSE Product Security Team
Advisory ID: SUSE-SU-2026:24282-1
Vendor Severity: high
CVE Count: 20
Additional Cves: CVE-2026-35204, CVE-2026-35205, CVE-2026-35206, CVE-2026-41178, CVE-2026-41888, CVE-2026-48978, CVE-2026-50151, CVE-2026-50163, CVE-2026-56852, CVE-2026-56854, CVE-2026-56855, CVE-2026-56864, CVE-2026-56865, CVE-2026-63209, CVE-2026-78662, CVE-2026-81870, CVE-2026-81871, CVE-2026-81872, CVE-2026-85732

References

Community reviews

Loading reviews…