CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-63308

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Score
5.3 medium
Published
2026-07-17
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
sysutils/helmhelm3.22.0_2unaddresseddanilo@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>helm</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of
	service vulnerability in the Files.Lines template helper in
	pkg/engine/files.go that allows attackers to trigger an index out of
	range panic by including zero-length byte slices in chart files.
	Attackers can include empty files in Helm charts to cause
	deterministic render failures across template, install, upgrade, lint,
	and SDK Engine.Render operations.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-63308</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-63308</url>
    </references>
    <dates>
      <discovery>2026-07-17</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>