Skip to main content

Helm CVE-2026-63308

| EUVDEUVD-2026-45213 MEDIUM
Improper Validation of Array Index (CWE-129)
2026-07-17 VulnCheck GHSA-5gjx-96wq-c8r2
Denial Of Service Red Hat Helm
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Chart delivered over network triggers panic on user-initiated render (UI:R); no privileges required on target; availability limited to the failing Helm process only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 17, 2026 - 16:50 vuln.today
Analysis Generated
Jul 17, 2026 - 16:50 vuln.today
CVE Published
Jul 17, 2026 - 16:14 cve.org
MEDIUM 5.3

DescriptionCVE.org

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

AnalysisAI

Denial of service in Helm's Files.Lines template helper (pkg/engine/files.go) allows any party who can supply a crafted chart to crash Helm operations deterministically by embedding a zero-length file. Affected are all Helm releases through 4.2.3 across template, install, upgrade, lint, and SDK Engine.Render code paths. A public proof-of-concept exists via GitHub issue #32279; this CVE is not listed in CISA KEV, and a patch is available in upstream commit ba6c9a29.

Technical ContextAI

Helm (cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*) is the de-facto Kubernetes package manager, and its Go template engine exposes a Files.Lines helper that splits chart file content into lines. The root cause is CWE-129 (Improper Validation of Array Index): the original guard in pkg/engine/files.go used a nil check (f[path] nil) which does not catch a zero-length but non-nil byte slice ([]byte{}). When Lines() attempts to index into such an empty slice, the Go runtime panics with 'index out of range', aborting the entire Helm operation. The fix in PR #32290 replaces the nil check with len(f[path]) 0, correctly handling both nil and empty-slice cases. Test cases for empty files, newline-only files, and missing files were added to the test suite to prevent regression.

RemediationAI

The primary fix is to upgrade to a Helm release that includes commit ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017 (https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017). The exact patched release tag is not independently confirmed from available data - monitor the Helm GitHub releases page (https://github.com/helm/helm/releases) for the first release after commit ba6c9a29 and upgrade to it. As an interim compensating control, add a pre-render validation step in CI/CD pipelines that rejects charts containing zero-byte files (e.g., find chart/ -empty -type f and fail the pipeline if any are found); this blocks the attack vector without requiring a Helm upgrade but adds pipeline complexity and may reject legitimate empty placeholder files. A second compensating control is to restrict chart ingestion to internal, audited repositories, preventing untrusted parties from supplying crafted charts to Helm rendering operations.

More in Helm

View all
CVE-2019-1000009 MEDIUM POC
6.5 Feb 04

Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Direct
CVE-2019-1000008 MEDIUM POC
6.5 Feb 04

All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restric
CVE-2019-18658 CRITICAL
9.8 Nov 12

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opport
CVE-2019-1010275 CRITICAL
9.8 Jul 17

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. Rated critical severity (CVSS 9.8), this vul
CVE-2020-11013 MEDIUM POC
5.0 Apr 24

Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. Rated medium sever
CVE-2021-32690 HIGH
8.6 Jun 16

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). Rated high severity (CVSS 8.6), th
CVE-2025-53547 HIGH
8.5 Jul 08

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a s
CVE-2026-35205 HIGH
8.4 Apr 09

Helm 4.0.0 through 4.1.3 silently installs Kubernetes plugins without cryptographic provenance verification even when si
CVE-2026-35204 HIGH
8.4 Apr 09

Path traversal in Helm 4.0.0-4.1.3 allows local attackers to write arbitrary files during plugin installation or update

CVE-2023-25165 MEDIUM POC
4.3 Feb 08

Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template funct
CVE-2024-26147 HIGH
7.5 Feb 21

Helm is a package manager for Charts for Kubernetes. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
CVE-2022-23526 HIGH
7.5 Dec 15

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Rated high severity (CVSS 7.5), this vulnerabil

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Containers 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-63308 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy