Every CVE Search/ Get API key

CVE-2026-63308

Helm Files.Lines Denial of Service via Empty Chart Files

5.3 MediumFix available

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.49%Up 0.3 points since Jul 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Helm Files.Lines Denial of Service via Empty Chart Files

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
CVE-2026-63308
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-129
Updated
2026-11-02
EUVDEUVD-2026-45213 5.3

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
EUVD-2026-45213
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5gjx-96wq-c8r2 5.3

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the...

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
GHSA-5gjx-96wq-c8r2
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-129
Updated
2026-11-02
NVD 5.3

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
CVE-2026-63308
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSV 5.3

Helm Files.Lines Denial of Service via Empty Chart Files

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
CVE-2026-63308
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-129
Updated
2026-11-02
OSVRHSA-2026:42230 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:42230
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVRHSA-2026:42241 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:42241
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:55180 4.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:55180
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-92991 No score

CVE-2026-63308 affecting package cert-manager for versions less than 1.12.15-11

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
AZL-92991
Updated
2026-11-05
OSVBIT-helm-2026-63308 No score

Helm Files.Lines Denial of Service via Empty Chart Files

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Record
BIT-helm-2026-63308
Updated
2026-11-02
OSVopenSUSE-SU-2026:11386-1 No score

helm-4.2.3-4.1 on GA media

These are all security issues fixed in the helm-4.2.3-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11386-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11387-1 No score

helm3-3.21.3-4.1 on GA media

These are all security issues fixed in the helm3-3.21.3-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11387-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21809-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.1:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21809-1
Updated
2026-11-02
OSVSUSE-SU-2026:23456-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23456-1
Updated
2026-11-02
OSVSUSE-SU-2026:23506-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.1:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23506-1
Updated
2026-11-02
OSVSUSE-SU-2026:23522-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23522-1
Updated
2026-11-02
OSVSUSE-SU-2026:23688-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.1:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23688-1
Updated
2026-11-02
OSVSUSE-SU-2026:3882-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

Record
SUSE-SU-2026:3882-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cert-manager
Azure Linux:3
 before 1.12.15-11
1.12.15-11
helm
Bitnami
 before 4.2.4
4.2.4
helm4
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:4.2.3-0.1.2.hum1
0:4.2.3-0.1.2.hum1
helm3
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.21.3-0.1.2.hum1
0:3.21.3-0.1.2.hum1
helm3
Red Hat:hummingbird:1
 before 0:3.21.4-0.1.hum1
0:3.21.4-0.1.hum1
c-ares
SUSE:Linux Micro 6.2
From an advisory covering 5 CVEs
 before 1.34.8-160000.1.1
1.34.8-160000.1.1
helm
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 3.21.3-2.1
3.21.3-2.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 3.21.3-slfo.1.1_2.1
3.21.3-slfo.1.1_2.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
helm
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 3 CVEs
 before 3.21.3-150000.1.93.1
3.21.3-150000.1.93.1
helm
openSUSE:Tumbleweed
 before 4.2.3-4.1
4.2.3-4.1
helm3
openSUSE:Tumbleweed
 before 3.21.3-4.1
3.21.3-4.1
helm
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63308 is a medium vulnerability (CVSS 5.3) in Helm, published July 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in cert-manager 1.12.15-11.

References

Show 49 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open