cert-manager
v1.19.3SecurityFeb 2, 2026
cert-manager v1.19.3 is a maintenance release with bug fixes, a Go toolchain update, and a security fix in the controller. The security issue concerns DNS responses that could trigger a controller panic and denial of service under the stated conditions.
Check if affected (1)
securitymediumGHSA-gx3x-vq4p-mhhv:
cert-manager controllerpanic fixApplies if an attacker can modify DNS responses or control the DNS server.
The
cert-manager controllercould panic when it cached a DNS response in an unexpected order. The issue, tracked as GHSA-gx3x-vq4p-mhhv, could cause denial of service when an attacker modified DNS responses or controlled the DNS server.
All 3 other recorded changesfixes 2 · value changes 1
fixes (2)
- - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. (#8415, @cert-manager-bot)
- - Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. (#8436, @cert-manager-bot)
value changes (1)
- - Bump go to 1.25.6 (#8459, @SgtCoDFish)
Add cert-manager to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.