Medium severity4.3NVD Advisory· Published Jul 17, 2026· Updated Jul 30, 2026
CVE-2026-63308
CVE-2026-63308
Description
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- osv-coords6 versionspkg:apk/chainguard/helm-4pkg:apk/wolfi/helm-4pkg:bitnami/helmpkg:rpm/opensuse/helm&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/helm&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/helm3&distro=openSUSE%20Tumbleweed
< 4.2.4-r0+ 5 more
- (no CPE)range: < 4.2.4-r0
- (no CPE)range: < 4.2.4-r0
- (no CPE)range: < 4.2.4
- (no CPE)range: < 3.21.3-160000.2.1
- (no CPE)range: < 4.2.3-4.1
- (no CPE)range: < 3.21.3-4.1
Patches
Vulnerability mechanics
References
4- github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017nvdPatch
- github.com/helm/helm/pull/32290nvdIssue TrackingPatch
- github.com/helm/helm/issues/32279nvdExploitIssue Tracking
- www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasourcenvdNot Applicable
News mentions
0No linked articles in our index yet.