RHSA-2026:1042HighCVSS 7.5

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

Published
January 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (5)

CVE-2025-61727 →CVE-2025-61729 →CVE-2025-66418 →CVE-2025-66471 →CVE-2026-21441 →

📋 Description

CVE-2025-61727 — golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products9

  • cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:08b6b8c954c1a7ceb5a446eb1bc3e28c434cc576b77cd369c85ea79775dfb1cc_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2f2e78fd6d5a22d977e80100425da58d77a5286d4d017c38e27d7900d52fdb28_s390x as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:749ce9e6e1216fc8e8e29c01ff14b11a1290de1bec9bd4d692f5cbace03f8e95_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:7906836c624e2aea656d2c64bd3fee260b69c9f6a0ab46e5d228154f5d6241c4_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:77f4d70980abe59f1e69bf38bfeeeed0b84b27fe9ae3286666d01a0c8aa6b067_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9f89f2a9de21e45f472d533a7b627c7f27fdf726efef24ff972cebfd30815cbf_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:bf234df32160c906c15cc437b66a7b35a913a400f921f2cd2e44c83a02d9c7b0_s390x as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c8c319818479dfb5856d50ccebe1c6aaad008aff2b1ac5c317763a697884b2c2_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.18

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)