CVE-2026-63308
mediumHelm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows a…
Vendor / product: Helm — helm
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
CVSS
6.5
6.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-17 17:17
Modified: 2026-10-29 21:17
NVD status: Modified
Last synced 9 hours ago
Verified against the source API 2026-10-29 21:28 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
helm / helm ≤4.2.3
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017
Patch / mitigation: https://github.com/helm/helm/pull/32290
References
- https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017 disclosure@vulncheck.com
- https://github.com/helm/helm/issues/32279 disclosure@vulncheck.com
- https://github.com/helm/helm/pull/32290 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/helm-files-lines-denial-of-service-via-empty-chart-fi... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-29 21:28 UTC · record ↗