CVE-2026-63308 Helm Files.Lines Denial of Service via Empty Chart Files
Attackers can cause Helm to crash by including empty files in charts, disrupting template rendering and deployment operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63308?
CVE-2026-63308 is a medium-severity denial of service vulnerability in helm, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
Weakness: CWE-129
Which versions are affected by CVE-2026-63308?
1 open source package ship an affected version, including helm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
helm Bitnami | All versions | 4.2.4 |
Linux distribution packages (3)
helm3 Red Hat:hummingbird:1 | All versions | 0:3.21.4-0.1.hum1 |
helm openSUSE:Tumbleweed | All versions | 4.2.3-4.1 |
helm3 openSUSE:Tumbleweed | All versions | 3.21.3-4.1 |
Products include Helm Helm.
How do I fix CVE-2026-63308?
Upgrade helm to 4.2.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63308 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63308 exists.
Other vulnerabilities in helm
- CVE-2019-18658 Helm Unsafe Link Following
- CVE-2019-1010275 Helm Improper Certificate Validation
- CVE-2019-25210 Information disclosure in n/a
- CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
- CVE-2020-11013 lookup Function Information Discolosure in Helm
Sources
Also known as AZL-92991, BIT-helm-2026-63308, GHSA-5gjx-96wq-c8r2, MINI-3h5r-v57f-2v9h, MINI-4c6c-3qrw-2xh6, MINI-p7jr-v694-qfc7 and 4 more.