Dashboard / CVE-2026-63308

CVE-2026-63308

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 61/100
Published: 2026-07-17 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: None
VC: None
VI: None
VA: Low

Description

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
helm helm 0
helm helm < 4.2.3
helm helm 0

References & Advisories (4)

https://github.com/helm/helm/issues/32279
technical-description exploit

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.49%
Raw Score 0.004860
Percentile 41.9%
Date 2026-11-02

EPSS Trend

2026-11-02
0.00486
2026-11-01
0.00486
2026-10-31
0.00486
2026-10-30
0.00486
2026-10-29
0.00486

Intelligence Sources

mitre ref →
nvd ref →

External Links