GHSA-gx3x-vq4p-mhhv

Suggest an improvement
Source
https://github.com/advisories/GHSA-gx3x-vq4p-mhhv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gx3x-vq4p-mhhv/GHSA-gx3x-vq4p-mhhv.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-gx3x-vq4p-mhhv
Aliases
Downstream
CGA (40)
MINI (8)
Published
2026-02-02T22:11:06Z
Modified
2026-07-17T21:13:36Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
cert-manager-controller DoS via Specially Crafted DNS Response
Details

Impact

The cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS.

An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in Denial of Service (DoS) of the cert-manager controller.

The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor.

Patches

The vulnerability was introduced in cert-manager v1.18.0 and has been patched in cert-manager v1.19.3 and v1.18.5, which are the supported minor releases at the time of publishing.

cert-manager versions prior to v1.18.0 are unaffected.

Workarounds

  • Using DNS-over-HTTPS reduces the risk of DNS traffic being intercepted and modified.
    • Note that DNS-over-HTTPS does not prevent the risk of an attacker-controlled authoritative DNS server.

Resources

Credits

Huge thanks to Oleh Konko (@1seal) for reporting the issue, providing a detailed PoC and an initial patch!

Database specific 
{
    "cwe_ids": [
        "CWE-129",
        "CWE-704"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T22:11:06Z",
    "nvd_published_at": "2026-02-04T22:15:58Z",
    "severity": "MODERATE"
}
References

Affected packages

Go / github.com/cert-manager/cert-manager

Package

Name
github.com/cert-manager/cert-manager
View open source insights on deps.dev
Purl
pkg:golang/github.com/cert-manager/cert-manager

Affected ranges

Type
SEMVER
Events
Introduced
1.18.0
Fixed
1.18.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gx3x-vq4p-mhhv/GHSA-gx3x-vq4p-mhhv.json"

Go / github.com/cert-manager/cert-manager

Package

Name
github.com/cert-manager/cert-manager
View open source insights on deps.dev
Purl
pkg:golang/github.com/cert-manager/cert-manager

Affected ranges

Type
SEMVER
Events
Introduced
1.19.0
Fixed
1.19.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gx3x-vq4p-mhhv/GHSA-gx3x-vq4p-mhhv.json"