CLEANSTART-2026-HR50080 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the cert-manager package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

AZL-99156 CVE-2026-78662 affecting package cert-manager 1.12.15-12

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99159 CVE-2026-56855 affecting package cert-manager 1.12.15-12

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-98343 CVE-2026-37236 affecting package cert-manager 1.12.15-12

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: kubernetes, commercial-grafana, external-dns, kube-conformance, cilium-cli, loki, milvus, minio, kyverno, hubble, multicluster-controlplane-fips, reports-server, cilium, rancher-support-bundle-kit, kine, multicluster-controlplane, dapr, cert-manager, kots...

GO-2026-6107 vulnerabilities

Vulnerabilities for packages: kyverno, kots, external-dns, kubernetes, cilium, dapr, cilium-cli, minio, cert-manager, kine, hubble, loki...

CVE-2026-73500 vulnerabilities

Vulnerabilities for packages: kyverno, kots, external-dns, kubernetes, cilium, dapr, cilium-cli, minio, cert-manager, kine, hubble, loki...

GHSA-6VCH-Q96H-7GC3 vulnerabilities

Vulnerabilities for packages: kyverno, kots, external-dns, kubernetes, cilium, dapr, cilium-cli, minio, cert-manager, kine, hubble, loki...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: k3s, kube-rbac-proxy, apisix-ingress-controller, kyverno, descheduler, cass-operator, datadog-agent, cert-manager-istio-csr, cloud-provider-gcp-cloud-controller-manager, keda, calico, kwok, crossplane, zot, pulumi-kubernetes-operator, kuma, kube-state-metrics, hubble...

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12

CVE-2026-73500 affecting package cert-manager for versions less than 1.12.15-12. A patched version of the package is available...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, flux-fips, zarf, rancher-fleet, zarf-fips, cert-manager-cmctl-fips, helm-diff-fips, rancher-fleet-fips, kuma, helm-diff, cilium-cli, helm-push, gitlab-operator, flux-source-controller, flux-source-controller-fips, flux, gitlab-operator-fips, kots...

GO-2026-5289 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr-fips, cert-manager-istio-csr...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: istio, cert-manager-istio-csr-fips, cert-manager-istio-csr...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, flux-fips, zarf, rancher-fleet, zarf-fips, cert-manager-cmctl-fips, helm-diff-fips, rancher-fleet-fips, kuma, helm-diff, cilium-cli, helm-push, gitlab-operator, flux-source-controller, flux-source-controller-fips, flux, gitlab-operator-fips, kots...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: opentelemetry-operator-fips, cert-manager-google-cas-issuer-fips, step-issuer-fips, gitlab-operator-fips, cert-manager-openshift-routes-fips, percona-xtradb-cluster-operator-fips, opentelemetry-operator, mariadb-operator-fips, cert-manager-cmctl,...

GO-2025-4116 vulnerabilities

Vulnerabilities for packages: backup-restore-operator, falco-no-driver, consul-k8s, rke2-runtime-fips, terraform, cert-manager-fips, etcd-fips, kube-conformance, k3s, gitlab-rails-ce, gitlab-rails-ce-fips, etcd, vault...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-istio-csr, step-issuer, cert-exporter-fips, cert-exporter, cert-manager-cmctl-fips, step-issuer-fips, cert-manager-webhook-pdns-fips, aws-privateca-issuer-fips, aws-privateca-issuer...