Helm up to version 4.2.3 processes chart files via the Files.Lines template helper. If a chart contains zero‑length byte slices, the helper triggers an index‑out‑of‑range panic that aborts the rendering process, leading to deterministic failures of template rendering, chart installation, upgrade, linting, and SDK engine rendering operations. This denial of service can disrupt automated deployments and operational workflows that rely on Helm chart rendering.

Helm package manager users running any version up to and including 4.2.3 are impacted. Systems that deploy, install, or upgrade Helm charts within Kubernetes environments are at risk if they use affected versions of Helm.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by adding empty files to a Helm chart—an action that requires only access to the chart source or a foothold that allows chart manipulation. The resulting panic is limited to the Helm rendering engine and does not provide arbitrary code execution, but it can interrupt automated deployments and operational workflows.