Read the docs
Red Hat Security Advisory

RHSA-2026:63135

cert-manager Operator for Red Hat OpenShift 1.19.2

Released 2026-09-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 17 records

TI-2026-07301 CVE-2026-8286 · GHSA-32xh-3x3c-6g6h

wrong STARTTLS connection reuse

Priority HIGH 70

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00309 Published 2026-07-03 Partial fix · 8.14.2, 8.16.1 +1 CWE-295
TI-2026-08389 CVE-2026-9547 · GHSA-xq9p-gxg6-f7q6

SSH improper host validation

Priority HIGH 68

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00361 Published 2026-07-03 Partial fix · 8.14.2, 8.16.1 +1 CWE-297
TI-2026-03272 CVE-2026-3783 · GHSA-8whr-249c-vfjp

token leak with redirect and netrc

Priority MEDIUM 63

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00495 Published 2026-03-11 Partial fix · 8.14.2, 8.16.1 +1 CWE-522
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r

Infinite loop on invalid input in golang.org/x/text

Priority LOW 39

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-07-21 Partial fix · 0.39.0 CWE-835
TI-2026-10207 CVE-2026-11824 · GHSA-8g48-4wfm-7247

SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate

Priority LOW 38

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00182 Published 2026-06-09 Partial fix · 3.53.2 CWE-122
TI-2026-39263 CVE-2026-54371 · GHSA-hh95-r7mj-c9j5

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

Priority LOW 35

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00146 Published 2026-06-29 Partial fix · 2.6.0 CWE-59
TI-2026-10205 CVE-2026-11822 · GHSA-6qj8-gw6p-hc5p

SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek

Priority LOW 31

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00195 Published 2026-06-09 Partial fix · 3.53.2 CWE-125
TI-2026-01624 CVE-2026-1965 · GHSA-q9qg-g2c3-3hr2

bad reuse of HTTP Negotiate connection

Priority LOW 29

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00297 Published 2026-03-11 Partial fix · 8.14.2, 8.16.1 +1 CWE-305