PT-2026-60806 · Helm · Helm

George Chen · CVE-2026-63308 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Exploit

Correção

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

CVE-2026-63308

Produtos afetados

Helm

Referências · 5

• 🔥 https://github.com/helm/helm/issues/32279 · Exploit
• https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017 · Correção
• https://github.com/helm/helm/pull/32290 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63308 · Nota de Segurança
• https://vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasource · Nota