CVE-2026-63308

Summary

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Affected Software

VendorProductVersion RangeStatus
helmhelm0 <= 4.2.3affected
helmhelmba6c9a29efa7bf9198dad6a5ec12b4fb30c96017unaffected

Weaknesses

  • CWE-129: Improper Validation of Array Index

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References