CVE-2026-63308: Helm Files.Lines Denial of Service via Empty Chart Files
Helm Files.Lines Denial of Service via Empty Chart Files
Other sources
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.12.15-11 - Upgrade
Upgrade
Helmto a version that resolves this vulnerability.Fixed in 4.2.3Patch ba6c9a2 - Compensating control
Apply deterministic chart validation to prevent inclusion of zero-length byte slices / empty files in Helm chart files until Helm is fixed (to avoid Files.Lines index-out-of-range panics during template, install, upgrade, lint, and SDK Engine render operations).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63308?
The severity of CVE-2026-63308 is medium with a score of 4.3.
How do I fix CVE-2026-63308?
To fix CVE-2026-63308, update to Helm version 4.2.4 or later, as the vulnerability was addressed in commit ba6c9a2.
What type of vulnerability is CVE-2026-63308?
CVE-2026-63308 is a denial of service vulnerability caused by zero-length byte slices in chart files leading to an out-of-bounds read.
In which versions of Helm is CVE-2026-63308 present?
CVE-2026-63308 is present in Helm versions up to 4.2.3.
What should I watch for regarding CVE-2026-63308?
Watch for the potential for attackers to include empty files in Helm chart files, leading to application crashes.