{"id":"EUVD-2026-5341","revision":null,"records":[{"revision":"d45a13f4b4db498c8accaf37dc832fdd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-25518","aliases":[],"title":"cert-manager-controller DoS via Specially Crafted DNS Response","description":"cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in denial‑of‑service (DoS) of the cert-manager controller. The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor. This issue has been patched in versions 1.18.5 and 1.19.3.","state":0,"publishedAt":"2026-02-04T21:18:06.681+00:00","modifiedAt":"2026-02-05T14:31:52.478+00:00","affected":[{"ecosystem":"Vendor product","name":"cert-manager","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"cert-manager\",\n                    \"product\": \"cert-manager\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.18.0, < 1.18.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.19.0, < 1.19.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv","https://github.com/cert-manager/cert-manager/pull/8467","https://github.com/cert-manager/cert-manager/pull/8468","https://github.com/cert-manager/cert-manager/pull/8469","https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc","https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d","https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-25518","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-25518","identifiers":["CVE-2026-25518"]},"retained":false,"historicalAffected":[]},{"revision":"f79ee55940e7401a8e1edff363a6698f","observedAt":"2026-11-15T07:40:35.594+00:00","statement":{"source":"euvd","id":"EUVD-2026-5341","aliases":["CVE-2026-25518","GHSA-gx3x-vq4p-mhhv"],"title":"cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to bef…","description":"cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in denial‑of‑service (DoS) of the cert-manager controller. The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor. This issue has been patched in versions 1.18.5 and 1.19.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":null}],"references":["https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv","https://github.com/cert-manager/cert-manager/pull/8467","https://github.com/cert-manager/cert-manager/pull/8468","https://github.com/cert-manager/cert-manager/pull/8469","https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc","https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d","https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5341","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 4, 2026, 9:18:06 PM","dateUpdated":"Feb 5, 2026, 2:31:52 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-1007","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-14550","CVE-2025-14831","CVE-2025-15281","CVE-2025-15366","CVE-2025-15367","CVE-2025-15599","CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59465","CVE-2025-59466","CVE-2025-68470","CVE-2025-9820","CVE-2026-0540","CVE-2026-0861","CVE-2026-0915","CVE-2026-0980","CVE-2026-1207","CVE-2026-1285","CVE-2026-1287","CVE-2026-1299","CVE-2026-1312","CVE-2026-1530","CVE-2026-1531","CVE-2026-1961","CVE-2026-21637","CVE-2026-22029","CVE-2026-23490","CVE-2026-2436","CVE-2026-25518","CVE-2026-27137","CVE-2026-27138","CVE-2026-27959","CVE-2026-29063","CVE-2026-29087","CVE-2026-30922","CVE-2026-3632","CVE-2026-3633","CVE-2026-3634","CVE-2026-3731","CVE-2026-4271","CVE-2026-4324","CVE-2026-5119"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-5341","identifiers":["EUVD-2026-5341","CVE-2026-25518","GHSA-gx3x-vq4p-mhhv"]},"retained":false,"historicalAffected":[]},{"revision":"5383615e8e9c48918d0cde80e5c99742","observedAt":"2026-10-25T06:17:16.233+00:00","statement":{"source":"nvd","id":"CVE-2026-25518","aliases":[],"title":"cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to bef…","description":"cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in denial‑of‑service (DoS) of the cert-manager controller. The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor. This issue has been patched in versions 1.18.5 and 1.19.3.","state":0,"publishedAt":"2026-02-04T22:15:58.99+00:00","modifiedAt":"2026-06-17T10:24:46.76+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc","https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d","https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2","https://github.com/cert-manager/cert-manager/pull/8467","https://github.com/cert-manager/cert-manager/pull/8468","https://github.com/cert-manager/cert-manager/pull/8469","https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25518","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-129","CWE-704"],"productCriteria":["cpe:2.3:a:cert-manager:cert-manager:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-02-04T22:15:58.990","lastModified":"2026-06-17T10:24:46.760"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-25518","identifiers":["CVE-2026-25518"]},"retained":false,"historicalAffected":[]},{"revision":"1b5e894911264d939abe3f3c72fd44d3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-gx3x-vq4p-mhhv","aliases":["BIT-cert-manager-2026-25518","CVE-2026-25518","GO-2026-4399"],"title":"cert-manager-controller DoS via Specially Crafted DNS Response","description":"### Impact\n\nThe cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS.\n\nAn attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in Denial of Service (DoS) of the cert-manager controller.\n\nThe issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor.\n\n### Patches\n\nThe vulnerability was introduced in cert-manager v1.18.0 and has been patched in cert-manager v1.19.3 and v1.18.5, which are the supported minor releases at the time of publishing.\n\ncert-manager versions prior to v1.18.0 are unaffected.\n\n### Workarounds\n\n- Using DNS-over-HTTPS reduces the risk of DNS traffic being intercepted and modified.\n    - Note that DNS-over-HTTPS does *not* prevent the risk of an attacker-controlled authoritative DNS server.\n\n### Resources\n\n- Fix for cert-manager 1.18: https://github.com/cert-manager/cert-manager/pull/8467\n- Fix for cert-manager 1.19: https://github.com/cert-manager/cert-manager/pull/8468\n- Fix for master branch: https://github.com/cert-manager/cert-manager/pull/8469\n\n### Credits\n\nHuge thanks to Oleh Konko (@1seal) for reporting the issue, providing a detailed PoC and an initial patch!","state":0,"publishedAt":"2026-02-02T22:11:06+00:00","modifiedAt":"2026-09-10T03:50:35.1670596+00:00","affected":[{"ecosystem":"Go","name":"github.com/cert-manager/cert-manager","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.18.0"},{"kind":"fixed","version":"1.18.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/cert-manager/cert-manager","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.19.0"},{"kind":"fixed","version":"1.19.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv","https://nvd.nist.gov/vuln/detail/CVE-2026-25518","https://github.com/cert-manager/cert-manager/pull/8467","https://github.com/cert-manager/cert-manager/pull/8468","https://github.com/cert-manager/cert-manager/pull/8469","https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc","https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d","https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2","https://github.com/cert-manager/cert-manager","https://pkg.go.dev/vuln/GO-2026-4399"],"sourceUrl":"https://github.com/advisories/GHSA-gx3x-vq4p-mhhv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gx3x-vq4p-mhhv","identifiers":["GHSA-gx3x-vq4p-mhhv","BIT-cert-manager-2026-25518","CVE-2026-25518","GO-2026-4399"]},"retained":false,"historicalAffected":[]},{"revision":"24ba6b927cba4600b3a1f79455bdeec0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4399","aliases":["BIT-cert-manager-2026-25518","CVE-2026-25518","GHSA-gx3x-vq4p-mhhv"],"title":"DoS in cert-manager-controller via Specially Crafted DNS Response in github.com/cert-manager/cert-manager","description":"DoS in cert-manager-controller via Specially Crafted DNS Response in github.com/cert-manager/cert-manager","state":0,"publishedAt":"2026-02-19T17:28:55+00:00","modifiedAt":"2026-03-16T14:55:08.06699+00:00","affected":[{"ecosystem":"Go","name":"github.com/cert-manager/cert-manager","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.18.0"},{"kind":"fixed","version":"1.18.5"},{"kind":"introduced","version":"1.19.0"},{"kind":"fixed","version":"1.19.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv","https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc","https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d","https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2","https://github.com/cert-manager/cert-manager/pull/8467","https://github.com/cert-manager/cert-manager/pull/8468","https://github.com/cert-manager/cert-manager/pull/8469"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4399","license":"OSV · upstream source license applies","key":"osv:GO-2026-4399","identifiers":["GO-2026-4399","BIT-cert-manager-2026-25518","CVE-2026-25518","GHSA-gx3x-vq4p-mhhv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.2867767+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.2867777+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-24e910670d68255a90dfc1d94d37ac5394a0a43e960361a78142e746e5b8e0e9","complete":true,"records":425790,"lastAttemptAt":"2026-11-15T13:01:16.7308429+00:00","lastSuccessAt":"2026-11-15T13:01:16.7018281+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:16.7308429+00:00","snapshotPublishedAt":"2026-11-15T12:22:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47f38f0996d04d31b51da25d0a0d9bc1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T13:17:28.4296709+00:00","lastSuccessAt":"2026-11-15T13:17:28.424+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:17:28.424+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13628,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.3027206+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.3027219+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-00496e381624434cb51cd6ee97f87d5f","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T13:02:04.5706057+00:00","lastSuccessAt":"2026-11-15T13:02:04.555+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:02:04.555+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T13:01:38.1237717+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:38.1237717+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T13:01:22.067621+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:22.067621+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T13:01:41.1317031+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:41.1317031+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T13:01:28.8971106+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:28.8971106+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}