{"cve":"CVE-2023-25165","nvd":{"published":"2023-02-08T20:15:24.937","modified":"2026-06-17T05:40:49.253","status":"Modified","description":"Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-200"],"references":["https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2","https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8","https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2","https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8"],"products":["helm:helm"],"source":"nvd","synced_at":"2026-10-19T21:37:38.595364862+00:00"},"epss":{"cve":"CVE-2023-25165","score":0.00768,"percentile":0.55595,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pwcw-6f5g-gxf8","url":"https://osv.dev/vulnerability/GHSA-pwcw-6f5g-gxf8","summary":"Helm vulnerable to information disclosure via getHostByName Function ","modified":"2026-09-10T03:50:07.877081483Z","packages":[{"ecosystem":"Go","name":"helm.sh/helm/v3","purl":"pkg:golang/helm.sh/helm/v3","ranges":[">=3.0.0 <3.11.1"],"fixed":["3.11.1"]}]},{"id":"GO-2023-1547","url":"https://osv.dev/vulnerability/GO-2023-1547","summary":"Information disclosure in helm.sh/helm/v3","modified":"2026-02-04T04:24:25.402649Z","packages":[{"ecosystem":"Go","name":"helm.sh/helm/v3","purl":"pkg:golang/helm.sh/helm/v3","ranges":["<3.11.1"],"fixed":["3.11.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}