chore(findings): dla/helm/helm-fips

Ghost User
2026-04-04T04:08:25Z

## Summary

dla/helm/helm-fips has 67 new findings discovered during continuous monitoring.

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=dla/helm/helm-fips&tag=3.15.3&branch=master

EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.

KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.

id | source | severity | package | impact | workaround | epss_score | kev
-- | ------ | -------- | ------- | ------ | ---------- | ---------- | ---
CVE-2025-22872 | Twistlock CVE | Medium | golang.org/x/net/html-v0.23.0 | | | 0.00129 | false
CVE-2024-36620 | Anchore CVE | Medium | github.com/docker/docker-v25.0.5+incompatible | | | 0.00060 | false
CVE-2024-36623 | Anchore CVE | High | github.com/docker/docker-v25.0.5+incompatible | | | 0.00054 | false
CVE-2024-45338 | Anchore CVE | Medium | golang.org/x/net-v0.23.0 | | | 0.00034 | false
CVE-2025-61726 | Twistlock CVE | High | net/url-1.25.0 | | | 0.00032 | false
CVE-2025-61726 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00032 | false
CVE-2026-25679 | Twistlock CVE | Low | net/url-1.25.0 | | | 0.00031 | false
CVE-2026-25679 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00031 | false
CVE-2025-61725 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00028 | false
CVE-2025-61725 | Twistlock CVE | Low | net/mail-1.25.0 | | | 0.00028 | false
CVE-2025-58186 | Twistlock CVE | Low | net/http-1.25.0 | | | 0.00028 | false
CVE-2025-58186 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00028 | false
CVE-2025-61723 | Twistlock CVE | High | encoding/pem-1.25.0 | | | 0.00027 | false
CVE-2025-61723 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00027 | false
CVE-2025-61729 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00023 | false
CVE-2025-61729 | Twistlock CVE | High | crypto/x509-1.25.0 | | | 0.00023 | false
CVE-2025-58185 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00023 | false
CVE-2025-58185 | Twistlock CVE | Medium | encoding/asn1-1.25.0 | | | 0.00023 | false
CVE-2025-61728 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00022 | false
CVE-2025-61728 | Twistlock CVE | Medium | archive/zip-1.25.0 | | | 0.00022 | false
CVE-2025-47912 | Twistlock CVE | Medium | net/url-1.25.0 | | | 0.00022 | false
CVE-2025-47912 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00022 | false
CVE-2025-58190 | Anchore CVE | Medium | golang.org/x/net-v0.23.0 | | | 0.00019 | false
CVE-2025-68121 | Anchore CVE | Critical | stdlib-go1.25.0 | | | 0.00017 | false
CVE-2025-68121 | Twistlock CVE | Critical | crypto/tls-1.25.0 | | | 0.00017 | false
CVE-2025-61724 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00016 | false
CVE-2025-68119 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00015 | false
CVE-2026-33186 | Twistlock CVE | Critical | google.golang.org/grpc-v1.58.3 | | | 0.00014 | false
CVE-2024-40635 | Twistlock CVE | Medium | github.com/containerd/containerd-v1.7.12 | | | 0.00014 | false
CVE-2025-58187 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00013 | false
CVE-2025-58187 | Twistlock CVE | High | crypto/x509-1.25.0 | | | 0.00013 | false
CVE-2025-47911 | Anchore CVE | Medium | golang.org/x/net-v0.23.0 | | | 0.00013 | false
CVE-2025-58183 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00012 | false
CVE-2026-27142 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00011 | false
CVE-2026-27142 | Twistlock CVE | Low | html/template-1.25.0 | | | 0.00011 | false
CVE-2025-61727 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00011 | false
CVE-2025-61727 | Twistlock CVE | Medium | crypto/x509-1.25.0 | | | 0.00011 | false
CVE-2025-47910 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00011 | false
CVE-2025-61731 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00009 | false
CVE-2025-58189 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00009 | false
CVE-2025-58189 | Twistlock CVE | Medium | crypto/tls-1.25.0 | | | 0.00009 | false
CVE-2025-64329 | Twistlock CVE | Medium | github.com/containerd/containerd-v1.7.12 | | | 0.00008 | false
CVE-2025-61730 | Anchore CVE | Medium | stdlib-go1.25.0 | | | 0.00008 | false
CVE-2025-61730 | Twistlock CVE | Medium | crypto/tls-1.25.0 | | | 0.00008 | false
CVE-2025-61732 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00006 | false
CVE-2025-58188 | Anchore CVE | High | stdlib-go1.25.0 | | | 0.00006 | false
CVE-2025-58188 | Twistlock CVE | High | crypto/x509-1.25.0 | | | 0.00006 | false
CVE-2024-25621 | Twistlock CVE | High | github.com/containerd/containerd-v1.7.12 | | | 0.00006 | false
CVE-2026-27139 | Anchore CVE | Low | stdlib-go1.25.0 | | | 0.00005 | false
CVE-2026-27139 | Twistlock CVE | Low | os-1.25.0 | | | 0.00005 | false
CVE-2025-54410 | Twistlock CVE | Low | github.com/docker/docker-v25.0.5 | | | 0.00005 | false
GHSA-x744-4wpc-v9h2 | Anchore CVE | High | github.com/docker/docker-v25.0.5+incompatible | | | N/A | N/A
GHSA-vvgc-356p-c3xw | Anchore CVE | Medium | golang.org/x/net-v0.23.0 | | | N/A | N/A
GHSA-v778-237x-gjrc | Anchore CVE | Critical | golang.org/x/crypto-v0.21.0 | | | N/A | N/A
GHSA-v23v-6jw2-98fq | Anchore CVE | Critical | github.com/docker/docker-v25.0.5+incompatible | | | N/A | N/A
GHSA-qxp5-gwg8-xv66 | Anchore CVE | Medium | golang.org/x/net-v0.23.0 | | | N/A | N/A
GHSA-pxq6-2prw-chj9 | Anchore CVE | Medium | github.com/docker/docker-v25.0.5+incompatible | | | N/A | N/A
GHSA-pwhc-rpq9-4c8w | Anchore CVE | High | github.com/containerd/containerd-v1.7.12 | | | N/A | N/A
GHSA-p77j-4mvh-x3m3 | Anchore CVE | Critical | google.golang.org/grpc-v1.58.3 | | | N/A | N/A
GHSA-p436-gjf2-799p | Anchore CVE | High | github.com/docker/cli-v25.0.1+incompatible | | | N/A | N/A
GHSA-m6hq-p25p-ffr2 | Anchore CVE | Medium | github.com/containerd/containerd-v1.7.12 | | | N/A | N/A
GHSA-j5w8-q4qc-rx2x | Anchore CVE | Medium | golang.org/x/crypto-v0.21.0 | | | N/A | N/A
GHSA-hcg3-q754-cr77 | Anchore CVE | High | golang.org/x/crypto-v0.21.0 | | | N/A | N/A
GHSA-f6x5-jh6r-wrfv | Anchore CVE | Medium | golang.org/x/crypto-v0.21.0 | | | N/A | N/A
GHSA-6v2p-p543-phr9 | Anchore CVE | High | golang.org/x/oauth2-v0.10.0 | | | N/A | N/A
GHSA-4vq8-7jfc-9cvp | Anchore CVE | Low | github.com/docker/docker-v25.0.5+incompatible | | | N/A | N/A
GHSA-265r-hfxg-fhmg | Anchore CVE | Medium | github.com/containerd/containerd-v1.7.12 | | | N/A | N/A

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=dla/helm/helm-fips&tag=3.15.3&branch=master

## Tasks

Contributor:
- [ ] Apply the ~"Status::Review" label to this issue for a `merge request review` and wait for feedback

OR

- [ ] Provide justifications for findings in the [VAT](https://vat.dso.mil) ([docs](https://docs-ironbank.dso.mil/hardening/justifications/))
- [ ] Apply the ~"Status::Verification" label to this issue for a `VAT justifications review` and wait for feedback

Iron Bank:
- [ ] Review findings and justifications

> Note: If the above process is rejected for any reason, the `Review` or `Verification` label will be removed and the issue will be sent back to `To-Do`. Any comments will be listed in this issue for you to address. Once they have been addressed, you **must** re-add the `Review` or `Verification` label.

## Questions?

Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add `/cc @ironbank-notifications/onboarding`.

Additionally, Iron Bank hosts an [AMA](https://www.zoomgov.com/meeting/register/vJIsdemoqTMpGpm-2c6xjdAm0MLD6vuvu5I) working session every Wednesday from 1630-1730EST to answer questions.