CVE-2026-63308: 
Helm vulnerability analysis and mitigation

CVE-2026-63308 is a denial-of-service vulnerability in the Files.Lines template helper (pkg/engine/files.go) of the Helm Kubernetes package manager. It affects Helm through version 4.2.3 (including all v3 releases from 3.13.0 onward and all v4 releases), and is fixed in commit ba6c9a2. An attacker can craft a Helm chart containing an empty file to trigger a deterministic index out of range [-1] panic, causing render failures across template, install, upgrade, lint, and SDK Engine.Render operations. The vulnerability carries a CVSS v3.1 score of 4.3 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, Helm Issue).

The root cause is improper validation of an array index (CWE-129) in the Files.Lines function in pkg/engine/files.go. The function guards against a nil map entry (f[path] == nil) but fails to account for the case where an empty file is stored as a non-nil, zero-length byte slice. When s := string(f[path]) produces an empty string, the subsequent trailing-newline check s[len(s)-1] attempts to index position -1, triggering a Go runtime panic. The engine recovers this panic and surfaces it as a render error, causing every Helm operation referencing the affected template to fail non-zero. The fix, merged in PR #32290, extends the guard to len(f[path]) == 0 and returns an empty slice, matching the existing behavior for missing files (Helm PR, Helm Commit).

Successful exploitation causes a deterministic denial of service affecting Helm rendering operations — specifically helm template, helm install, helm upgrade, helm lint, and any SDK Engine.Render call that references the malicious chart. There is no confidentiality or integrity impact; the vulnerability is limited to availability, causing all affected operations to exit non-zero and fail. In CI/CD pipelines or automated deployment workflows that rely on Helm, this could block deployments entirely for any chart containing the crafted empty file (Github Advisory, Helm Issue).

1. Craft a malicious Helm chart: Create a chart directory structure with an empty file in the files/ directory (e.g., panicchart/files/empty.txt with zero bytes).
2. Add a vulnerable template: Include a template that references the empty file using the Files.Lines helper, e.g., {{- range .Files.Lines "files/empty.txt" }}{{ . }}{{- end }}.
3. Distribute or submit the chart: Deliver the crafted chart to a target that will process it — for example, by submitting it to a Helm repository, sharing it with a user, or including it in a CI/CD pipeline that runs helm template, helm install, or helm lint.
4. Trigger the panic: When the target runs any Helm rendering operation against the chart, the Files.Lines function indexes s[-1] on the empty string, triggering a Go runtime panic recovered as a render error, causing the operation to exit non-zero and fail deterministically (Helm Issue, Helm PR).

• Logs: Helm CLI output containing runtime error: index out of range [-1] or error calling Lines: runtime error: index out of range [-1] in template rendering errors; non-zero exit codes from helm template, helm install, helm upgrade, or helm lint operations referencing a chart with empty files.
• File System: Presence of zero-byte files inside a Helm chart's files/ directory combined with templates using {{ .Files.Lines "<path>" }}; unexpected empty files (e.g., empty.txt, placeholder.txt) in chart archives (.tgz).
• Process: Helm processes terminating unexpectedly with panic stack traces referencing pkg/engine/files.go in debug output (--debug flag output showing the panic origin).

The fix is available in commit ba6c9a2 merged into the Helm main branch on July 16, 2026; users should update to any Helm release that includes this commit (post-4.2.3 for v4, or the v3 backport tracked in PR #32303). As a workaround prior to patching, validate chart contents to ensure no zero-byte files exist in the files/ directory before processing, and avoid using {{ .Files.Lines }} on files that may be empty. Implementing input validation in chart rendering pipelines to detect and reject charts containing zero-length files is also recommended (Helm Commit, Github Advisory).

The vulnerability was originally reported via email on May 26, 2026, with no initial response, and subsequently filed as a public GitHub issue on July 1, 2026. The fix PR (#32290) was reviewed and approved by Helm maintainers gjenkins8 and TerryHowe and merged on July 16, 2026. A v3 backport PR (#32303) was also opened to address affected v3 releases. No significant broader media coverage or notable external researcher commentary has been identified beyond the GitHub issue and PR discussion (Helm Issue, Helm PR).