Executive brief
Helm, a popular package manager for Kubernetes, contains a flaw that can cause it to crash when processing certain configuration files. An attacker can provide a specially crafted Helm chart containing an empty file which causes the software to fail during installation, upgrades, or testing. This results in a denial of service where users are unable to deploy or manage their applications using the affected tool.
Technical details
A denial of service vulnerability exists in Helm's template engine within the `Files.Lines` helper in `pkg/engine/files.go`. The root cause is an improper validation of array indices (CWE-129); specifically, the code checks if a file is nil but fails to check if it is a zero-length byte slice before attempting to access the last character to check for a trailing newline. An attacker can include an empty file in a Helm chart, which triggers an "index out of range [-1]" panic during rendering. This affects `helm template`, `install`, `upgrade`, `lint`, and SDK `Engine.Render` operations. The issue is fixed in commit ba6c9a2 and impacts versions 3.13.0 through 4.2.3.
Affected products
- Helm Helm 3.13.0 through 3.21.0, 4.0.0 through 4.2.3
Timeline
- 2026-05-26: disclosed: Vulnerability reported to maintainers via email
- 2026-07-01: other: Public issue opened on GitHub
- 2026-07-16: patched: Fix merged into main branch
- 2026-07-17: advisory: CVE published