Read the docs
TI-2026-45154 Aliases CVE-2026-63308GHSA-5gjx-96wq-c8r2

Helm Files.Lines Denial of Service via Empty Chart Files

Priority MEDIUM 57CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
helmhelmup to 4.2.3—Patch availableCNA
  • helm Vendorhelm Affected up to 4.2.3 Fixed in — Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*up to 4.2.3Vulnerablehelm
  • cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions up to 4.2.3 Vulnerable ·helm

Remediation

Red Hat 3 advisories

  • RHSA-2026:55180 Released 2026-08-15 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm3-3.21.4-0.1.hum1@aarch64, helm3-3.21.4-0.1.hum1@src, helm3-3.21.4-0.1.hum1@x86_64
  • RHSA-2026:42241 Released 2026-07-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images helm3-3.21.3-0.1.2.hum1@aarch64, helm3-3.21.3-0.1.2.hum1@src, helm3-3.21.3-0.1.2.hum1@x86_64
  • RHSA-2026:42230 Released 2026-07-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm4-4.2.3-0.1.2.hum1@aarch64, helm4-4.2.3-0.1.2.hum1@src, helm4-4.2.3-0.1.2.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat OpenShift GitOpsAffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:42230, RHSA-2026:42241, RHSA-2026:55180

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63308
  2. 2026-10-03 Alias added: GHSA-5gjx-96wq-c8r2
  3. 2026-10-30 Affected versions changed · Red Hat

References

Exploit 1

Patch 2

  • TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
  • TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
  • TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
  • TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
  • TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8
  • TI-2024-17237 Helm's Missing YAML Content Leads To Panic CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences