CVE-2026-63308

Katalog CVE

CVSS 6.5 · Medium EPSS 0,49%

Kerentanan Improper Validation of Array Index pada helm. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-129: Improper Validation of Array Index

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017 patch
• https://github.com/helm/helm/pull/32290 issue tracking · patch
• https://github.com/helm/helm/issues/32279 exploit · issue tracking
• https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasourc... not applicable