CVE-2026-63308
MEDIUMHelm Files.Lines Denial of Service via Empty Chart Files
Title source: cnaDescription
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
References (4)
Core 4
Core References
Exploit technical-description
exploit
Researcher Disclosure
https://github.com/helm/helm/issues/32279
Patch patch
Patch Commit
https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasource
Scores
CVSS v3
4.3
EPSS
0.0023
EPSS Percentile
14.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-129
Status
published
Products (2)
helm/helm
< 4.2.3 (2 CPE variants)
helm/helm
ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017
Published
Jul 17, 2026
Tracked Since
Jul 17, 2026