CLEANSTART-2026-HR50080 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the cert-manager package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

AZL-99156 CVE-2026-78662 affecting package cert-manager 1.12.15-12

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99159 CVE-2026-56855 affecting package cert-manager 1.12.15-12

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-98343 CVE-2026-37236 affecting package cert-manager 1.12.15-12

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: kots, multicluster-controlplane, loki, hubble, cilium, kube-conformance, kine, kyverno, commercial-grafana, multicluster-controlplane-fips, dapr, cilium-cli, reports-server, cert-manager, external-dns, kubernetes, rancher-support-bundle-kit, minio, milvus...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: cilium-cli, kubernetes, kine, minio, loki, kyverno, dapr, cilium, external-dns, cert-manager, hubble, kots...

GHSA-6VCH-Q96H-7GC3 vulnerabilities

Vulnerabilities for packages: cilium-cli, kubernetes, kine, minio, loki, kyverno, dapr, cilium, external-dns, cert-manager, hubble, kots...

CVE-2026-73500 vulnerabilities

Vulnerabilities for packages: cilium-cli, kubernetes, kine, minio, loki, kyverno, dapr, cilium, external-dns, cert-manager, hubble, kots...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: datadog-operator, opentelemetry-operator, rancher-agent, cilium, cluster-api-ipam-provider-in-cluster, zot, pulumi-kubernetes-operator, metrics-server, cert-manager-webhook-pdns, external-secrets-operator, tkn, yunikorn-k8shim, telegraf, vcluster, spicedb,...

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12. A patched version of the package is available...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: gitlab-operator, rancher-fleet-fips, kuma, flux-source-controller, kots, flux-fips, flux, helm-push, flux-source-controller-fips, cilium-cli, gitlab-operator-fips, cert-manager-cmctl-fips, helm-diff-fips, zarf-fips, helm-diff, cert-manager-cmctl, zarf, rancher-fleet...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr-fips, cert-manager-istio-csr, istio...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: gitlab-operator, rancher-fleet-fips, kuma, flux-source-controller, kots, flux-fips, flux, helm-push, flux-source-controller-fips, cilium-cli, gitlab-operator-fips, cert-manager-cmctl-fips, helm-diff-fips, zarf-fips, helm-diff, cert-manager-cmctl, zarf, rancher-fleet...

GO-2026-5289 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr-fips, cert-manager-istio-csr...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer-fips, step-issuer, cert-manager-openshift-routes-fips, percona-xtradb-cluster-operator, percona-xtradb-cluster-operator-fips, percona-server-mongodb-operator-fips, step-issuer-fips, percona-server-mongodb-operator, opentelemetry-operator-fips,...

GO-2025-4116 vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, etcd, vault, etcd-fips, consul-k8s, backup-restore-operator, kube-conformance, gitlab-rails-ce, falco-no-driver, cert-manager-fips, k3s, terraform, gitlab-rails-ce-fips...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer-fips, step-issuer, cert-manager-istio-csr, aws-privateca-issuer, cert-manager-cmctl-fips, cert-exporter-fips, cert-manager-webhook-pdns, step-issuer-fips, cert-manager-cmctl, cert-exporter, cert-manager-webhook-pdns-fips...