CVE-2022-36049

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
fluxcd	flux2	>= 0.0.4, < 0.23.0; >= 0.0.17, < 0.32.0

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44996Mailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48360Mailing List, Third Party Advisory
https://github.com/fluxcd/flux2/security/advisories/GHSA-p2g7-xwvr-rrw3Third Party Advisory
https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxhThird Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44996Mailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48360Mailing List, Third Party Advisory
https://github.com/fluxcd/flux2/security/advisories/GHSA-p2g7-xwvr-rrw3Third Party Advisory
https://github.com/helm/helm/security/advisories/GHSA-7hfp-qfw3-5jxhThird Party Advisory

Timeline

Published: Sep 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-36057.8The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection CVE-2022-360518.8ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** f CVE-2022-360528.8Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in Contiki-NG may CVE-2022-360538.8Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-N CVE-2022-360548.8Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG CVE-2022-360556.5Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identifi CVE-2022-360565.5Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a nu CVE-2022-360574.8Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affecte CVE-2022-360587.5Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks CVE-2022-360595.3matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings CVE-2022-36065.5A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the fil CVE-2022-360605.3matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt