Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-63308Helm Files.Lines Denial of Service via Empty Chart Files

Medium 4.3

In plain English

A medium-severity security flaw in helm from helm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Affected products (as reported)

Vendor	Product	Versions
helm	helm	0 – through 4.2.3

Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References

Researcher Disclosure technical-description, exploit
Pull Request issue-tracking
Patch Commit patch
VulnCheck Advisory: Helm Files.Lines Denial of Service via Empty Chart Files third-party-advisory