Helm Files.Lines Denial of Service via Empty Chart Files
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-63308US | medium6.5 | — | ||
Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger a… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017FIX
- https://github.com/helm/helm/issues/32279EVIDENCE
- https://github.com/helm/helm/pull/32290FIX
- https://nvd.nist.gov/vuln/detail/CVE-2026-63308WEB
- https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasourceWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan