Cert Manager (Redhat) - vulnerabilities (CVEs)

72 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2026-09-08. Vendor: Redhat.

CVEs of Cert Manager

CVE-2026-74860 - CVSS 8.5 (high), 2026-09-08: A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document…
CVE-2026-15588 - CVSS 5.3 (medium), 2026-07-20: A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to…
CVE-2026-16118 - CVSS 7.1 (high), 2026-07-17: A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian…
CVE-2026-58016 - CVSS 9.1 (critical), 2026-06-30: A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed…
CVE-2026-58015 - CVSS 7.5 (high), 2026-06-30: A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context…
CVE-2026-58014 - CVSS 8.6 (high), 2026-06-30: A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with…
CVE-2026-58013 - CVSS 8.2 (high), 2026-06-30: A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a…
CVE-2026-58012 - CVSS 8.2 (high), 2026-06-30: A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change…
CVE-2026-58010 - CVSS 8.2 (high), 2026-06-30: A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment…
CVE-2026-58011 - CVSS 7.5 (high), 2026-06-30: A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid…
CVE-2026-14164 - CVSS 7.5 (high), 2026-06-30: A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain…
CVE-2026-13757 - CVSS 6.2 (medium), 2026-06-29: A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form…
CVE-2026-54371 - CVSS 8.4 (high), 2026-06-29: attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges…
CVE-2026-42014 - CVSS 6.6 (medium), 2026-06-16: A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free…
CVE-2026-27145 - CVSS 7.5 (high), 2026-06-02: (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused…
CVE-2026-5419 - CVSS 3.7 (low), 2026-06-01: A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote…
CVE-2026-5260 - CVSS 8.2 (high), 2026-05-26: A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key…
CVE-2026-42015 - CVSS 5.3 (medium), 2026-05-26: A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the…
CVE-2026-42013 - CVSS 8.2 (high), 2026-05-26: A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall…
CVE-2026-42012 - CVSS 7.1 (high), 2026-05-26: A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource…
CVE-2026-48864 - CVSS 7.8 (high), 2026-05-26: A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to…
CVE-2026-39821 - CVSS 9.6 (critical), 2026-05-22: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
CVE-2026-46595 - CVSS 10 (critical), 2026-05-22: Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key,…
CVE-2026-42508 - CVSS 9.1 (critical), 2026-05-22: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for…
CVE-2026-39835 - CVSS 7.5 (high), 2026-05-22: SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting…
CVE-2026-39828 - CVSS 8.8 (high), 2026-05-22: When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially…
CVE-2026-39832 - CVSS 9.1 (critical), 2026-05-22: When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination…
CVE-2026-39830 - CVSS 9.1 (critical), 2026-05-22: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine…
CVE-2026-39829 - CVSS 7.5 (high), 2026-05-22: The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter…
CVE-2026-42009 - CVSS 7.5 (high), 2026-05-18: A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator…
CVE-2026-42499 - CVSS 7.5 (high), 2026-05-07: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVE-2026-39820 - CVSS 7.5 (high), 2026-05-07: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
CVE-2026-33814 - CVSS 7.5 (high), 2026-05-07: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a…
CVE-2026-33811 - CVSS 7.5 (high), 2026-05-07: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
CVE-2026-42011 - CVSS 7.4 (high), 2026-05-07: A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs)…
CVE-2026-42010 - CVSS 9.8 (critical), 2026-05-07: A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character…
CVE-2026-33846 - CVSS 7.5 (high), 2026-05-04: A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where…
CVE-2026-3833 - CVSS 7.4 (high), 2026-04-30: A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for…
CVE-2026-3832 - CVSS 3.7 (low), 2026-04-30: A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP)…
CVE-2026-33845 - CVSS 9.1 (critical), 2026-04-30: A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and…
CVE-2026-35469 - CVSS 8.7 (high), 2026-04-16: spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate…
CVE-2026-4878 - CVSS 7 (high), 2026-04-09: A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function.…
CVE-2026-39883 - CVSS 8.8 (high), 2026-04-08: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an…
CVE-2026-32283 - CVSS 7.5 (high), 2026-04-08: If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled…
CVE-2026-32280 - CVSS 7.5 (high), 2026-04-08: During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in…
CVE-2026-33810 - CVSS 8.8 (high), 2026-04-08: When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different…
CVE-2026-29181 - CVSS 7.5 (high), 2026-04-07: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value…
CVE-2026-34986 - CVSS 7.5 (high), 2026-04-06: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE),…
CVE-2026-5121 - CVSS 9.8 (critical), 2026-03-30: A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker…
CVE-2026-2100 - CVSS 7.5 (high), 2026-03-26: A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber…
CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
CVE-2026-4424 - CVSS 7.5 (high), 2026-03-19: A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS…
CVE-2026-4111 - CVSS 7.5 (high), 2026-03-13: A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a…
CVE-2026-31837 - CVSS 8.7 (high), 2026-03-10: Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver…
CVE-2026-27137 - CVSS 7.5 (high), 2026-03-06: When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different…
CVE-2026-25679 - CVSS 7.5 (high), 2026-03-06: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2025-14831 - CVSS 5.3 (medium), 2026-02-09: A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via…
CVE-2025-61726 - CVSS 7.5 (high), 2026-01-28: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited…
CVE-2025-9820 - CVSS 4 (medium), 2026-01-26: A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label…
CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
CVE-2025-14512 - CVSS 6.5 (medium), 2025-12-11: A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib…
CVE-2025-14087 - CVSS 9.8 (critical), 2025-12-10: A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code…
CVE-2025-14104 - CVSS 6.1 (medium), 2025-12-05: A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()`…
CVE-2025-8941 - CVSS 7.8 (high), 2025-08-13: A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race…
CVE-2025-7425 - CVSS 7.8 (high), 2025-07-10: A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such…
CVE-2025-6020 - CVSS 7.8 (high), 2025-06-17: A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their…
CVE-2025-6170 - CVSS 2.5 (low), 2025-06-16: A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program…
CVE-2025-49796 - CVSS 9.1 (critical), 2025-06-16: A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an…
CVE-2025-49794 - CVSS 9.1 (critical), 2025-06-16: A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the…
CVE-2025-5914 - CVSS 7.8 (high), 2025-06-09: A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an…
CVE-2025-5278 - CVSS 4.4 (medium), 2025-05-27: A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the…
CVE-2024-12401 - CVSS 4.4 (medium), 2024-12-12: A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret…