CVE-2026-63308: 
Helm vulnerability analysis and mitigation

CVE-2026-63308 is a denial-of-service vulnerability in the Helm Kubernetes package manager affecting the Files.Lines template helper in pkg/engine/files.go. It allows attackers to trigger an "index out of range [-1]" panic by including zero-length byte slices (empty files) in Helm chart packages, causing deterministic render failures. Affected versions include helm.sh/helm/v3 from 3.13.0 onward and all helm.sh/helm/v4 releases through 4.2.3; the vulnerability is fixed in commit ba6c9a2. It carries a CVSS v3.1 score of 4.3 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, Helm Issue).

The root cause is improper validation of an array index (CWE-129) in the Files.Lines function within pkg/engine/files.go. The function guards against a nil map entry (f[path] == nil) but fails to account for the case where an empty file is stored as a non-nil, zero-length byte slice. When s := string(f[path]) produces an empty string, the subsequent trailing-newline check s[len(s)-1] attempts to index position -1, triggering a Go runtime panic. The engine recovers this panic and surfaces it as a render error, causing every helm template, install, upgrade, lint, and SDK Engine.Render call that references the empty file to fail with a non-zero exit code. The fix, merged in PR #32290, extends the guard to len(f[path]) == 0 and returns an empty slice, matching the existing behavior for missing files (Helm Issue, Helm PR, Helm Commit).

Successful exploitation causes a deterministic denial of service affecting Helm's core rendering pipeline — specifically template, install, upgrade, lint, and SDK Engine.Render operations. Any chart that includes an empty file and references it via Files.Lines will fail to render, blocking deployments and upgrades in affected environments. There is no confidentiality or integrity impact; the vulnerability is limited to availability of Helm rendering operations (Github Advisory).

The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept available), with the original issue report including a minimal reproducible chart that demonstrates the panic. The vulnerability is not automatable and requires user interaction (passive), meaning a user must process a malicious chart. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.234% (14th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Helm Issue).

1. Craft a malicious Helm chart: Create a chart directory structure with an empty file in the files/ directory (e.g., touch panicchart/files/empty.txt) and a Chart.yaml with standard metadata.
2. Add a vulnerable template: Include a template that references the empty file using the Files.Lines helper, e.g., {{- range .Files.Lines "files/empty.txt" }}{{ . }}{{- end }}.
3. Distribute the chart: Share the chart via a Helm repository, OCI registry, or direct file transfer to a target that will process it.
4. Trigger the panic: When the victim runs helm template ./panicchart, helm install, helm upgrade, or helm lint against the chart, the Files.Lines function panics with runtime error: index out of range [-1], causing the operation to fail non-zero and blocking the deployment pipeline (Helm Issue, Helm PR).

• Logs: Helm CLI output containing runtime error: index out of range [-1] or error calling Lines: runtime error: index out of range [-1] in template rendering errors; non-zero exit codes from helm template, helm install, helm upgrade, or helm lint commands referencing charts with empty files.
• File System: Presence of zero-byte files within the files/ directory of a Helm chart package (.tgz or unpacked chart directory); chart templates containing {{ range .Files.Lines "..." }} blocks referencing such empty files.
• Process: Helm processes terminating unexpectedly with panic stack traces in stderr output mentioning pkg/engine/files.go (Helm Issue).

The fix is available in commit ba6c9a2 merged into the helm:main branch on July 16, 2026; users should update to a Helm release that includes this commit once a tagged release (e.g., v4.2.4 or later) is published. A backport PR (#32303) for the v3 branch was also opened. As a workaround prior to patching, validate chart contents to ensure no zero-byte files exist in the files/ directory before processing, and implement input validation in chart rendering pipelines to detect and reject malformed chart structures. Red Hat has also issued an errata (RHSA-2026:42230) for affected downstream packages (Helm PR, Helm Commit, Github Advisory).

The vulnerability was originally reported via email on May 26, 2026, with no initial response, and subsequently filed as a public GitHub issue on July 1, 2026. The fix PR (#32290) was reviewed and approved by Helm maintainers gjenkins8 and TerryHowe and merged on July 16, 2026. Community members noted as of late July 2026 that the fix had not yet been included in a tagged release (v4.2.4 had not been published), prompting requests for a release timeline (Helm Issue, Helm PR).