Vulnerability Description
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Helm | Helm | <= 4.2.3 |
Related Weaknesses (CWE)
References
- https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017Patch
- https://github.com/helm/helm/issues/32279ExploitIssue Tracking
- https://github.com/helm/helm/pull/32290Issue TrackingPatch
- https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-viNot Applicable
FAQ
What is CVE-2026-63308?
CVE-2026-63308 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range...
How severe is CVE-2026-63308?
CVE-2026-63308 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-63308?
Check the references section above for vendor advisories and patch information. Affected products include: Helm Helm.