CVE-2026-63308 is a denial of service vulnerability in Helm's chart-rendering engine where the Files.Lines template helper does not validate that included chart files contain at least one line before indexing. When a zero-length file is included in a Helm chart, it triggers an index out of range panic causing deterministic failures in Helm commands like template, install, upgrade, lint, and SDK Engine.Render. Red Hat has rated the impact as moderate, with a low availability impact since the panic only terminates the local Helm process without affecting long-running services or data integrity. Exploitation requires processing a crafted chart containing an empty file from an untrusted source.

The vulnerability causes Helm to crash during chart processing operations, resulting in denial of service for those Helm commands. It does not lead to data corruption or unauthorized data exposure. The impact on availability is low because the failure affects only the local Helm invocation and does not disrupt persistent services.

Red Hat advises upgrading to a fixed version of Helm to resolve this issue. There is no configuration change that fully prevents the vulnerability. As a workaround, users should verify that Helm charts from untrusted or third-party sources do not contain zero-byte files before processing them with Helm commands such as template, install, upgrade, lint, or SDK Engine.Render.