CVE Feed

    Dashboard / CVE / CVE-2026-63308

    CVE-2026-63308

    Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

    Published:Jul 17, 2026
    Last Modified:Jul 17, 2026
    EPS:Jul 17, 2026
    EPSS Score:
    CVSS Score:4.3

    Affected Products

    Vendor
    Helm
    Product
    Helm

    Exploits

    https://github.com/helm/helm/issues/32279

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-100 Overflow Buffers

    Related CVEs

    CVE-2026-35206 (CVSS 4.8) — Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafte…
    CVE-2026-35205 (CVSS 8.4) — Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing pr…
    CVE-2026-35204 (CVSS 8.4) — Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, whe…
    CVE-2025-55198 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and inde…
    CVE-2025-55199 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON S…
    CVE-2025-53547 (CVSS 8.5) — Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file alon…
    CVE-2025-32386 (CVSS 6.5) — Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be sig…
    CVE-2025-32387 (CVSS 6.5) — Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a d…
    CVE-2019-25210 (CVSS 6.5) — An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of…
    CVE-2024-26147 (CVSS 7.5) — Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variabl…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High