CVE-2026-63308: Helm Files.Lines Denial of Service via Empty Chart Files
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
helmto a version that resolves this vulnerability.Fixed in 4.2.3Patch ba6c9a2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63308?
The severity of CVE-2026-63308 is medium with a score of 4.3.
How do I fix CVE-2026-63308?
To fix CVE-2026-63308, update to Helm version 4.2.4 or later, as the vulnerability was addressed in commit ba6c9a2.
What type of vulnerability is CVE-2026-63308?
CVE-2026-63308 is a denial of service vulnerability caused by zero-length byte slices in chart files leading to an out-of-bounds read.
In which versions of Helm is CVE-2026-63308 present?
CVE-2026-63308 is present in Helm versions up to 4.2.3.
What should I watch for regarding CVE-2026-63308?
Watch for the potential for attackers to include empty files in Helm chart files, leading to application crashes.