CVE-2026-63308
Description
A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures during template, installation, upgrade, linting, and SDK Engine.Render operations.
Statement
A denial of service flaw was found in Helm, a package manager for Kubernetes. The Files.Lines template helper in the chart-rendering engine does not check that an included chart file contains at least one line before indexing into it. A chart that contains a zero-length file causes an index-out-of-range panic, which stops the current template, install, upgrade, lint, or SDK Engine.Render operation from completing.
Red Hat rates this issue as having a Moderate impact. Exploitation requires that a user or automated pipeline process a chart containing an empty file with Helm; the crafted chart must first be supplied by an untrusted chart source or repository. Because the panic only terminates the local Helm invocation rather than a long-running service, and does not expose or corrupt data, Red Hat assesses the impact to availability as Low, which is why Red Hat's score differs from the "High" availability impact used by NVD.
Mitigation
There is no configuration change that fully prevents this issue; upgrading to a fixed version of Helm resolves it. As a workaround, verify that Helm charts obtained from third-party or untrusted sources do not contain zero-byte files before processing them with `helm template`, `helm install`, `helm upgrade`, `helm lint`, or the SDK Engine.Render function.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | 6.5 | 4.3 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | Low | High | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
