https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:20:24.606611+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-4673 CVE-2025-4673 — Sensitive headers not cleared on cross-origin redirect in net/http 2026-10-08T14:20:24.609686+00:00

Affected: Go standard library net/http

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-9h84-qmv7-982p GHSA-9h84-qmv7-982p — Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion 2026-10-08T14:20:24.609738+00:00

Affected: Go: helm.sh/helm/v3

A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.

### Impact A malicious chart can point `$ref` in _values.schema.json_ to a device (e.g. `/dev/*`) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.

### Patches This issue has been resolved in Helm v3.18.5.

### Workarounds Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of `$ref` pointing to `/dev/zero`.

### References Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits Disclosed by Jakub Ciolek at AlphaSense.