VYPR
Unrated severityNVD Advisory· Published Jul 17, 2026· Updated Jul 17, 2026

Helm Files.Lines Denial of Service via Empty Chart Files

CVE-2026-63308

Description

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Affected products

2

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.