Helm 4.2.3 Files.Lines OOB Crash DoS
CVE-2026-63308 Published on July 17, 2026
Helm Files.Lines Denial of Service via Empty Chart Files
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
Vulnerability Analysis
CVE-2026-63308 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-63308. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
What is an out-of-bounds array index Vulnerability?
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVE-2026-63308 has been classified to as an out-of-bounds array index vulnerability or weakness.
Products Associated with CVE-2026-63308
Want to know whenever a new CVE is published for Helm? stack.watch will email you.
Affected Versions
helm:- Before and including 4.2.3 is affected.
- Version ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017 is unaffected.