Skip to content
Sign in
5.3 Medium

CVE-2026-63308 Helm Files.Lines Denial of Service via Empty Chart Files

Description

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
Passive
Confidentiality
None
Integrity
None
Availability
Low
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
helm 4.2 earliest → 4.2.3 No fix stated

Other CVEs of helm

The 25 CVEs of helm →
CVE-2026-35206 Helm is a package manager for Charts for Kubernetes 4.8 Medium CVE-2026-35205 Helm is a package manager for Charts for Kubernetes 8.4 High CVE-2026-35204 Helm is a package manager for Charts for Kubernetes 8.4 High CVE-2025-55198 Helm is a package manager for Charts for Kubernetes 6.5 Medium
Track this CVE