Threats Tagged 'cve-2026-63308'

This security update for Helm addresses multiple vulnerabilities across several dependencies, including grpc-gateway, OpenTelemetry baggage parsing, oras-go registry authentication, and grpc-go components. The issues range from HTTP method override bypasses, denial of service via oversized inputs or crashes, credential exfiltration risks, to authorization bypasses and memory exhaustion. The update consolidates fixes into Helm version 3.21.1.

CVE-2026-63308 is a medium severity security vulnerability affecting the helm3 package. It is addressed in the helm3-3.21.4-0.1.hum1 update for Red Hat Hardened Images and the helm3-3.21.3-4.1 package on openSUSE Tumbleweed. The vulnerability involves issues tracked under CWE-129 and CWE-1285. No known exploits are reported in the wild. The vendor has released an official fix.

A denial of service vulnerability exists in Helm 3.21.3-0.1.2.hum1 used in Red Hat Hardened Images. The flaw occurs when Helm processes chart files containing zero-length byte slices (empty files), causing an index out-of-range panic in the Files.Lines template helper. This panic terminates Helm operations such as template rendering, installation, upgrade, and linting. The vulnerability requires a crafted chart from an untrusted source and affects local Helm invocations without exposing or corrupting data.

A denial of service vulnerability exists in Helm 4.2.3-0.1.2.hum1 used in Red Hat Hardened Images. The flaw occurs when Helm processes chart files containing zero-length byte slices (empty files), causing an index out of range panic in the Files.Lines template helper. This panic terminates Helm operations such as template rendering, installation, upgrade, linting, and SDK Engine.Render. The issue affects local Helm invocations and does not expose or corrupt data.