Threats affecting pkg:rpm/suse/helm

This security update for Helm addresses multiple vulnerabilities across several dependencies, including grpc-gateway, OpenTelemetry baggage parsing, oras-go registry authentication, and grpc-go components. The issues range from HTTP method override bypasses, denial of service via oversized inputs or crashes, credential exfiltration risks, to authorization bypasses and memory exhaustion. The update consolidates fixes into Helm version 3.21.1.

This security update for Helm addresses two vulnerabilities by updating to version 3.20.2. The first vulnerability (CVE-2025-55199) involves specially crafted JSON Schema that can cause out of memory (OOM) termination. The second vulnerability (CVE-2026-35206) allows a specially crafted Chart to extract contents to an unintended output directory. The update also includes other bug fixes and dependency updates.