Medium severity · published Jul 17, 2026
CVE-2026-63308
Helm Files.Lines Denial of Service via Empty Chart Files
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
helm · helm
through 4.2.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63308
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63308
Patch
https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017
Exploit
https://github.com/helm/helm/issues/32279
Issue Tracking
https://github.com/helm/helm/pull/32290
Not Applicable
https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasource
More from helm
9.8
CVE-2019-18658
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive…
9.8
CVE-2019-1010275
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation
8.6
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
8.6
CVE-2025-53547
Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
8.6
CVE-2021-32690
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources)