RHSA-2026:1168HighCVSS 7.5

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

Published
January 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (5)

CVE-2025-61727 →CVE-2025-61729 →CVE-2025-66418 →CVE-2025-66471 →CVE-2026-21441 →

📋 Description

CVE-2025-61727 — golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products9

  • cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:155383c4664ea3ed18d0f079be720ad68a5de044448a744d7579af7ff0fc7e0a_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3258027c0fb9426c9ee3567f6dc0d02b85cb661c23300b230f5b1400b43bac25_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3bfbc3e69db31103145500f38f7a1db8e7f0462608e5a425674942606aa03ece_s390x as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:daa6b60824e45c6f31efd64b86995e23279fe310dde2f0293c762354f74d969f_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:09c857f0c20721d6b447f5f567182befc1ca6157128225849117a5c830feab23_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:63f4e63f3249b6271041d31fcfbf69c3ad699d319302e8fdb2bff5e1b1418707_s390x as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f1b903ff69100fa938d6bdf4d730d35158eec905351344a246e30ef14c847222_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.18
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:f27e4637dc8b67703abb24f246ee6d59ee3b3637ce5c47ab63b7935553f419e2_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.18

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)