CLEANSTART-2026-HR50080 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the cert-manager package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

AZL-99156 CVE-2026-78662 affecting package cert-manager 1.12.15-12

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99159 CVE-2026-56855 affecting package cert-manager 1.12.15-12

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-98343 CVE-2026-37236 affecting package cert-manager 1.12.15-12

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: cilium, cert-manager, kots, kyverno, kube-conformance, commercial-grafana, rancher-support-bundle-kit, reports-server, multicluster-controlplane, minio, kine, hubble, loki, milvus, kubernetes, cilium-cli, external-dns, multicluster-controlplane-fips, dapr...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: kine, cilium, hubble, kyverno, dapr, cert-manager, kubernetes, loki, minio, kots, cilium-cli, external-dns...

CVE-2026-73500 vulnerabilities

Vulnerabilities for packages: kine, cilium, hubble, kyverno, dapr, cert-manager, kubernetes, loki, minio, kots, cilium-cli, external-dns...

GHSA-6VCH-Q96H-7GC3 vulnerabilities

Vulnerabilities for packages: kine, cilium, hubble, kyverno, dapr, cert-manager, kubernetes, loki, minio, kots, cilium-cli, external-dns...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, rancher-agent, spicedb-operator, cluster-autoscaler, cluster-api-gcp-controller, kubescape-operator, rancher-system-agent, keda, kubernetes-csi-external-snapshotter, external-secrets-operator, tkn, cluster-api-aws-controller, cluster-api,...

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12. A patched version of the package is available...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: kots, cert-manager-cmctl-fips, flux, gitlab-operator, kuma, helm-diff, zarf-fips, rancher-fleet-fips, cilium-cli, helm-push, rancher-fleet, helm-diff-fips, flux-source-controller-fips, zarf, cert-manager-cmctl, gitlab-operator-fips, flux-source-controller, flux-fips...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: istio, cert-manager-istio-csr-fips, cert-manager-istio-csr...

GO-2026-5289 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr-fips, cert-manager-istio-csr...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: kots, cert-manager-cmctl-fips, flux, gitlab-operator, kuma, helm-diff, zarf-fips, rancher-fleet-fips, cilium-cli, helm-push, rancher-fleet, helm-diff-fips, flux-source-controller-fips, zarf, cert-manager-cmctl, gitlab-operator-fips, flux-source-controller, flux-fips...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, cert-manager-istio-csr, cert-manager-openshift-routes, percona-server-mongodb-operator, step-issuer-fips, cert-manager-webhook-pdns, percona-xtradb-cluster-operator-fips, opentelemetry-operator-fips, percona-server-mongodb-operator-fips,...

GO-2025-4116 vulnerabilities

Vulnerabilities for packages: backup-restore-operator, consul-k8s, cert-manager-fips, kube-conformance, etcd, k3s, terraform, falco-no-driver, vault, rke2-runtime-fips, gitlab-rails-ce-fips, gitlab-rails-ce, etcd-fips...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: step-issuer, cert-manager-cmctl-fips, cert-manager-istio-csr, cert-manager-webhook-pdns-fips, cert-exporter-fips, step-issuer-fips, aws-privateca-issuer, aws-privateca-issuer-fips, cert-manager-cmctl, cert-manager-webhook-pdns, cert-exporter...