RHSA-2026:0990HighCVSS 7.5

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

Published
January 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (5)

CVE-2025-61729 →CVE-2025-66418 →CVE-2025-66471 →CVE-2026-21441 →CVE-2025-61727 →

📋 Description

CVE-2025-61727 — golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products9

  • cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:0a08f25c01d26cf0833fb5fd2e2b77e11b7ee92016c6e039594180262496212f_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:399c99087dd8b4b6f790dddaa6cd284a1aa459eb641c5b788e1b926e9d0f6a7e_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:41f1f7807a760ba804e71971810977dc63010a17ccd74b607aaf01fb28386cbc_s390x as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:cbfb1c86b988a242eb25774b3f1f32d1f29795335c6e4e49f6b3b0065c5af459_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:1f62aebd5bbdd5809116b4575adfec3d51c24e48ce188aaf3b06dd26826bc737_s390x as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:28b8e7c5383ce99ef0589242494e9cbb30d0ef94ee16a54c191ab0b434128923_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:3ca7fb070c05efc25fe53af6fc922875ecb9d11943d3c243b2840d7ca2b1aa33_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:5c7fc6f10f7d9f5299ca42feadd98da0ce9d53835e89f8690a74ccd62e20dde5_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.18

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)