Repository navigation
Update Go dependencies to address unresolved CVEs in Helm 3 #32768
Description
What happened?
Summary
The Helm 3 binary (/usr/local/bin/helm) has been flagged for multiple security vulnerabilities affecting the Go standard library (stdlib), net/http, crypto/tls, and golang.org/x/net packages.
According to the vulnerability scan, the affected components include Go 1.26.8 and golang.org/x/net 0.57.0. The reported fixed versions are Go 1.27.2 and golang.org/x/net 0.60.0, with Go 1.26.9 also listed as a fix for some vulnerabilities.
These vulnerabilities are still being reported in Helm 3, and an update to the relevant Go toolchain and dependencies may be required to resolve them.
Affected CVEs
The following vulnerabilities were identified in /usr/local/bin/helm:
CVE | Severity | Affected component | Reported fixed version
-- | -- | -- | --
CVE-2026-56857 | Critical | Go standard library (stdlib) | Go 1.27.2
CVE-2026-94440 | High | Go standard library (stdlib) | Go 1.27.2
CVE-2026-78659 | High | golang.org/x/net, stdlib | x/net 0.60.0 / Go 1.27.2
CVE-2026-97031 | High | crypto/tls, stdlib | Go 1.27.2
CVE-2026-94439 | High | net/http, stdlib | Go 1.27.2
CVE-2026-78667 | High | net/http, stdlib | Go 1.27.2
CVE-2026-56866 | High | net/http, net/http/httputil, stdlib | Go 1.27.2
CVE-2026-78663 | Critical | golang.org/x/net, golang.org/x/net/http2, net/http, stdlib | Go 1.26.9 / 1.27.2; x/net 0.60.0
CVE-2026-78669 | High | golang.org/x/net, golang.org/x/net/http2, net/http, stdlib
What did you expect to happen?
Issue should be fixed in helm 3 latest version
How can we reproduce it (as minimally and precisely as possible)?
I have mentioned CVE numbers for reference
Helm version
Details
$ helm version
# paste output hereKubernetes version
Details
$ kubectl version
# paste output here
Activity
shaktisingh404 commentedon Nov 4, 2026
I looked into this. The dependency side is already fixed on
dev-v3:golang.org/x/netis at v0.60.0 (#32759) andgolang.org/x/cryptoat v0.58.0.Running
govulncheck ./...ondev-v3:The release workflow already uses
GOLANG_VERSION=1.26withcheck-latest: true, so no code change seems needed. A new v3 patch release would pick up Go 1.26.10 and resolve these. Would it be possible to cut one before v3 security support ends on Nov 11?@bhushanbhavsar25 your report mentions x/net 0.57.0, so you may be on a version older than v3.22.1.
helm versionoutput would help confirm.