{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cert-manager Operator for Red Hat OpenShift 1.17.1",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities\nand certificates as first-class resource types in the Kubernetes API. This makes it possible to provide\ncertificates-as-a-service to developers working within your Kubernetes cluster.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:5645",
        "url": "https://access.redhat.com/errata/RHSA-2026:5645"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47907",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47907"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-58183",
        "url": "https://access.redhat.com/security/cve/CVE-2025-58183"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html",
        "url": "https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5645.json"
      }
    ],
    "title": "Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.1",
    "tracking": {
      "current_release_date": "2026-08-01T22:44:38+00:00",
      "generator": {
        "date": "2026-08-01T22:44:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:5645",
      "initial_release_date": "2026-03-24T15:38:55+00:00",
      "revision_history": [
        {
          "date": "2026-03-24T15:38:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-25T05:39:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-01T22:44:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "cert-manager operator for Red Hat OpenShift 1.17",
                "product": {
                  "name": "cert-manager operator for Red Hat OpenShift 1.17",
                  "product_id": "cert-manager operator for Red Hat OpenShift 1.17",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cert_manager:1.17::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "cert-manager operator for Red Hat OpenShift"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3A9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12?arch=amd64\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774341716"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Aabcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f?arch=amd64\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774342146"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3Aa1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea?arch=s390x\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774341716"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132?arch=s390x\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774342146"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3Ac73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13?arch=ppc64le\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774341716"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f?arch=ppc64le\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774342146"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-rhel9@sha256%3A6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f?arch=arm64\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774341716"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
                "product": {
                  "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
                  "product_id": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a?arch=arm64\u0026repository_url=registry.redhat.io/cert-manager\u0026tag=1774342146"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.17",
          "product_id": "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        },
        "product_reference": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le",
        "relates_to_product_reference": "cert-manager operator for Red Hat OpenShift 1.17"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-47907",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2025-08-07T16:01:06.247481+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2387083"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "database/sql: Postgres Scan Race Condition",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability marked as Moderate severity issues rather than Important. The os/exec LookPath flaw requires a misconfigured PATH to be exploitable, and the database/sql race condition primarily impacts applications that cancel queries while running multiple queries concurrently. Both can cause unexpected behavior, but the exploitation scope is limited and unlikely to result in direct compromise in most typical deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "RHBZ#2387083",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2387083"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47907",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/693735",
          "url": "https://go.dev/cl/693735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/74831",
          "url": "https://go.dev/issue/74831"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM",
          "url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3849",
          "url": "https://pkg.go.dev/vuln/GO-2025-3849"
        }
      ],
      "release_date": "2025-08-07T15:25:30.704000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T15:38:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5645"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "database/sql: Postgres Scan Race Condition"
    },
    {
      "cve": "CVE-2025-58183",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-10-29T23:01:50.573951+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2407258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to be able to process a specially crafted GNU tar pax 1.0 archive with the application using the archive/tar package. Additionally, this issue can cause the Go application to allocate a large amount of memory, eventually leading to an out-of-memory condition and resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-58183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2407258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-58183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-58183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/709861",
          "url": "https://go.dev/cl/709861"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/75677",
          "url": "https://go.dev/issue/75677"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
          "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4014",
          "url": "https://pkg.go.dev/vuln/GO-2025-4014"
        }
      ],
      "release_date": "2025-10-29T22:10:14.376000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T15:38:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5645"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/tar: Unbounded allocation when parsing GNU sparse map"
    },
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T15:38:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5645"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-61728",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:39.965024+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736713",
          "url": "https://go.dev/cl/736713"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77102",
          "url": "https://go.dev/issue/77102"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4342",
          "url": "https://pkg.go.dev/vuln/GO-2026-4342"
        }
      ],
      "release_date": "2026-01-28T19:30:31.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T15:38:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5645"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
    },
    {
      "cve": "CVE-2025-61729",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2025-12-02T20:01:45.330964+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418462"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418462",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/725920",
          "url": "https://go.dev/cl/725920"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76445",
          "url": "https://go.dev/issue/76445"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
          "url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4155",
          "url": "https://pkg.go.dev/vuln/GO-2025-4155"
        }
      ],
      "release_date": "2025-12-02T18:54:10.166000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T15:38:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5645"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "cve": "CVE-2025-68121",
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
          "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-24T15:38:55+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
          "product_ids": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5645"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x",
            "cert-manager operator for Red Hat OpenShift 1.17:registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    }
  ]
}