Helm: index-out-of-range panic rendering charts that contain empty files

Impact

A chart containing a zero-length file makes Helm's Files.Lines helper panic with an index out of range, failing template, install, upgrade, lint and any SDK Engine.Render call. For a GPU fleet this is a deploy-path availability bug, not a node compromise: the chart that ships the device plugin, GPU operator or inference release stops rendering, and a GitOps controller embedding the Helm SDK fails the same way on every reconcile until the chart is fixed. It is deterministic, so a single bad chart blocks rollouts and rollbacks rather than causing intermittent failures. No code execution or data exposure is claimed.

Who can reach it

Anyone who can get a chart into the render path - a chart author, a dependency pulled from a registry, or a user submitting a chart to a CD pipeline. The record requires user interaction (someone must render the chart); no privileges beyond that.

What to do

Upgrade Helm past 4.2.3 to a release containing commit ba6c9a2; replace the client binary and update any service embedding the Helm SDK, then restart that controller. No node drain or reboot is involved. Until then, reject charts containing zero-length files in CI.

References

Related entries

• Traefik Gateway API provider: extensionRef resolved in the wrong namespace, letting a route bind an ungranted MiddlewareCVE-2026-65601 · Traefik Kubernetes Gateway API provider (HTTPRoute extensionRef namespace resolution)Medium
• Traefik: IngressRouteTCP ignores crossProviderNamespaces, letting any namespace borrow file-provider mTLS identityCVE-2026-65602 · Traefik (IngressRouteTCP serversTransport cross-provider allowlist)Medium
• JFrog Artifactory: authenticated write outside the Docker repository cache pathCVE-2026-66384 · JFrog Artifactory (Docker remote repository cache path)Medium
• Envoy: semicolon path parameters make routing pick an unprotected route for a protected resourceCVE-2026-73511 · Envoy HTTP path matching (ignore_path_parameters_in_path_matching, semicolon matrix parameters)Medium
• Envoy: scoped IPv6 address reconstruction aborts the proxy process in ORIGINAL_DST and QUIC pathsCVE-2026-73549 · Envoy Utility::copyInternetAddressAndPort and QUIC client-address handling (scoped IPv6 addresses)Medium
• Envoy: path normalization misses ..;param segments, bypassing path-based routing and RBACCVE-2026-73551 · Envoy (URL path normalization, dot segments with semicolon parameters)Medium