CVE-2026-63308
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A denial of service vulnerability in Helm through version 4.2.3 (fixed in commit ba6c9a2) causes an index out of range panic in the Files.Lines template helper in pkg/engine/files.go. Attackers can include empty files in Helm charts, leading to deterministic render failures during template, install, upgrade, lint, and SDK Engine.Render operations.
Risk Assessment
The organization is exposed to denial of service (DoS) attacks via malicious Helm charts containing empty files, potentially disrupting CI/CD pipelines and application deployment processes.
Recommendation
Immediately upgrade Helm to a version containing commit ba6c9a2 or later. Before upgrading, verify all used Helm charts for the presence of empty files.
Other vulnerabilities in Helm
See all- CVE-2026-66016Medium
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
- CVE-2026-35205High
Helm versions 4.0.0 through 4.1.3 install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in version 4.1.4.
- CVE-2026-35204High
A vulnerability in Helm from version 4.0.0 to 4.1.3 allows writing plugin contents to arbitrary filesystem locations via a crafted 'version' field in plugin.yaml containing '/../' (dot-dot) path separators.
Original NVD description (English source)
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.