CVE-2022-36049: Flux2 Helm Controller denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-07 · updated 2026-06-17
Weakness: CWE-400

Description

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.

Affected products

fluxcd flux2: from 0.0.17 before 0.32.0 — fixed in 0.32.0
fluxcd Helm-Controller: from 0.0.4 before 0.23.0 — fixed in 0.23.0
helm: from 3.0.0 before 3.9.4 — fixed in 3.9.4

How to fix

Upgrade to a fixed version: fluxcd flux2 0.32.0; fluxcd Helm-Controller 0.23.0; helm 3.9.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-36049 or the next vulnerability affects your stack