The vulnerability CVE-2026-63308 affects Helm, a Kubernetes package manager, specifically in version 3.21.3-0.1.2.hum1 as shipped in Red Hat Hardened Images RPMs. The Files.Lines template helper does not validate that included chart files contain at least one line before indexing, leading to an index out-of-range panic when processing zero-length files. This causes deterministic denial of service by crashing Helm commands such as install, upgrade, lint, and SDK Engine.Render. The flaw impacts availability locally but does not expose or corrupt data. Red Hat rates the impact as Moderate, with a Low availability impact due to the local nature of the crash. The issue is fixed in updated Helm versions, and mitigation involves upgrading Helm or verifying charts do not contain empty files.

The vulnerability causes a denial of service by crashing Helm operations that process malformed charts containing empty files. This disrupts local Helm commands like template rendering, installation, upgrade, and linting. There is no data exposure or corruption, and the crash only affects the local Helm process, not long-running services. Exploitation requires supplying a crafted chart from an untrusted source to a user or automated pipeline using Helm.

A fixed version of Helm is available and upgrading to it resolves the issue. As a workaround, users should verify that Helm charts from untrusted or third-party sources do not contain zero-byte files before processing them with Helm commands such as 'helm template', 'helm install', 'helm upgrade', or 'helm lint'. No configuration changes fully prevent this issue.