CVE-2026-63308

Aliases:openSUSE-SU-2026:11386-1openSUSE-SU-2026:11387-1RHSA-2026:55180CGA-2qrc-c63v-xmxqCGA-3x28-r54v-2hq9CGA-h3m6-q55x-mw8rCGA-wqvw-37f3-4rfj
Advisory lineage Upstream: 0 Downstream: 7
Analyzed
Published: 17 Jul 2026, 16:14
Last modified:17 Jul 2026, 17:25

Vulnerability Summary

Overall Risk (default)
medium
36/100
CVSS Score
6.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.27% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

17 Jul 2026, 16:14
Published
Vulnerability first disclosed
17 Jul 2026, 17:25
Last Modified
Vulnerability information updated

Description

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.27%• Percentile: 20%

Techniques & Countermeasures

  • CWE-129•Improper Validation of Array Index

    The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Affected Systems

  • chainguard•helm-3

    all

  • chainguard•helm-4

    < 4.2.4-r0

  • wolfi•helm-3

    all

  • wolfi•helm-4

    < 4.2.4-r0

  • helm•helm

    ≤ 4.2.3

  • opensuse•helm3&distro=openSUSE Tumbleweed

    < 3.21.3-4.1

  • opensuse•helm&distro=openSUSE Tumbleweed

    < 4.2.3-4.1

  • redhat•helm3

    < 0:3.21.4-0.1.hum1

References (15)