{"id":"CVE-2026-25518","aliases":["BIT-cert-manager-2026-25518","GHSA-gx3x-vq4p-mhhv","GO-2026-4399"],"url":"https://o3.security/vulnerability/CVE-2026-25518","summary":"cert-manager-controller DoS via Specially Crafted DNS Response","details":"### Impact\n\nThe cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS.\n\nAn attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in Denial of Service (DoS) of the cert-manager controller.\n\nThe issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor.\n\n### Patches\n\nThe vulnerability was introduced in cert-manager v1.18.0 and has been patched in cert-manager v1.19.3 and v1.18.5, which are the supported minor releases at the time of publishing.\n\ncert-manager versions prior to v1.18.0 are unaffected.\n\n### Workarounds\n\n- Using DNS-over-HTTPS reduces the risk of DNS traffic being intercepted and modified.\n    - Note that DNS-over-HTTPS does *not* prevent the risk of an attacker-controlled authoritative DNS server.\n\n### Resources\n\n- Fix for cert-manager 1.18: https://github.com/cert-manager/cert-manager/pull/8467\n- Fix for cert-manager 1.19: https://github.com/cert-manager/cert-manager/pull/8468\n- Fix for master branch: https://github.com/cert-manager/cert-manager/pull/8469\n\n### Credits\n\nHuge thanks to Oleh Konko (@1seal) for reporting the issue, providing a detailed PoC and an initial patch!","published":"2026-02-04T21:18:06.681Z","modified":"2026-10-28T02:30:32.877454306Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/cert-manager/cert-manager","fixedVersion":"1.18.5"},{"ecosystem":"Go","name":"github.com/cert-manager/cert-manager","fixedVersion":"1.19.3"}],"fix":{"url":"https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc","label":"cert-manager/cert-manager@409fc24"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25518.json"},{"type":"ADVISORY","url":"https://github.com/cert-manager/cert-manager/security/advisories/GHSA-gx3x-vq4p-mhhv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25518"},{"type":"FIX","url":"https://github.com/cert-manager/cert-manager/commit/409fc24e539711a07aae45ed45abbe03dfdad2cc"},{"type":"FIX","url":"https://github.com/cert-manager/cert-manager/commit/9a73a0b3853035827edd37ac463e4803ba10327d"},{"type":"FIX","url":"https://github.com/cert-manager/cert-manager/commit/d4faed26ae12115cceb807cdc12507ebc28980e2"},{"type":"FIX","url":"https://github.com/cert-manager/cert-manager/pull/8467"},{"type":"FIX","url":"https://github.com/cert-manager/cert-manager/pull/8468"},{"type":"FIX","url":"https://github.com/cert-manager/cert-manager/pull/8469"},{"type":"PACKAGE","url":"https://github.com/cert-manager/cert-manager"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2026-4399"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:32.877454306Z"}}