Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

cert-manager can be halted by crafted messages

published 1 month ago
Summary

The cert-manager software can have its communication channel stopped if an attacker sends specially formed messages after a connection is set up. This would freeze the service, preventing it from issuing or renewing certificates. Update cert-manager to the latest version that includes the fix, or apply the vendor's recommended patches.

What to do
  • Update cleanstart cert-manager to version 1.21.1-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart cert-manager < 1.21.1-r1
Fix: upgrade to 1.21.1-r1
Original advisory text
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-KC15122 · OSV
Track software like this
Free during beta