VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/cert-manager/cert-manager: vulnerability history, versions and safety

github.com/cert-manager/cert-manager is a package in the Go ecosystem. Vulert records 5 vulnerabilities for it across 120 releases, from Nov 2024 to Feb 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
5 vulnerabilities recorded M3 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
2 in the last 12 months

Most recent disclosure 19 Feb 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/cert-manager/cert-manager vulnerabilities

Vulert verdict on github.com/cert-manager/cert-manager v1.21.2 i

Updated on 23 Oct 2026

Action needed: v1.21.2 has 3 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 90/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.21.2 — affected i
  • Vulnerabilities on record 5 over 1 year · 2 in the last year i
  • Latest disclosure 19 Feb 2026 i
  • Highest CVSS 6.9 i
  • With no published fix 0 i
  • Stars 14,127 i
  • OpenSSF scorecard 7/10 i
  • Last release 1 month ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/cert-manager/cert-manager, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022190235-b4e42b76e09f 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261022190235-b4e42b76e09f 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261022183635-5a47542a6496 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261022181248-e6f4cf078476 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261022181235-53b39167ff88 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261022124536-8f4954f2baaf 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261022124536-8f4954f2baaf 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261022011835-29c8a506ad27 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261022011835-29c8a506ad27 22 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261021171133-0109bdb6bd33 21 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261021171133-0109bdb6bd33 21 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261020192644-28fb76d7019c 20 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261020192644-28fb76d7019c 20 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261019172943-9267bbc3a7ae 19 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261019172943-9267bbc3a7ae 19 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261015155440-f52a98e1a5c9 15 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261015155440-f52a98e1a5c9 15 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.3-0.20261014103737-7c32f61772ea 14 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261014103038-edc82c11b95d 14 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.20.5-0.20261014103038-edc82c11b95d 14 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261014095838-1f97571719f2 14 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261014095838-1f97571719f2 14 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261013170038-ed8c53ffaa11 13 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261013170038-ed8c53ffaa11 13 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261013130338-c54c03a072c6 13 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261013130338-c54c03a072c6 13 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261013125039-723e8a58230e 13 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261012120936-ef9ac73859da 12 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261012120936-ef9ac73859da 12 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261011151435-9266af4308fc 11 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261011151435-9266af4308fc 11 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261011080136-041b864a6fe0 11 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261011080136-041b864a6fe0 11 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261010061639-5a97216f81f2 10 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261010061639-5a97216f81f2 10 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261009164330-14cdf1b0a89a 09 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261009164330-14cdf1b0a89a 09 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.3-0.20261009163332-1b3813d371c7 09 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261009011530-e71e2cc345e5 09 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261009011530-e71e2cc345e5 09 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261008164729-860677f5c073 08 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261008164729-860677f5c073 08 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261008115428-ba1f133b0912 08 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261008115428-ba1f133b0912 08 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261008011729-c94536d5ebef 08 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261008011729-c94536d5ebef 08 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261005222326-363e374660a9 05 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261005222326-363e374660a9 05 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.3-0.20261005060551-9f71dc9bb709 05 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261004204851-d17acec07e12 04 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261004204851-d17acec07e12 04 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261004113248-8d77f2aeab4e 04 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261004113248-8d77f2aeab4e 04 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261003140912-def0e82d4f2b 03 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261003140912-def0e82d4f2b 03 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20261002041513-21ea77071f1b 02 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20261002041513-21ea77071f1b 02 Oct 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260930151711-27d70ee7ffa6 30 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260930151711-27d70ee7ffa6 30 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260930150512-142e3a955a19 30 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260930085709-b8ce4ef1da4f 30 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260930085709-b8ce4ef1da4f 30 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260929165409-05b683c98ec6 29 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260929165409-05b683c98ec6 29 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260929164009-ff522705985a 29 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.20.5-0.20260929164009-ff522705985a 29 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260929162810-99086786fe03 29 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260928180608-fd7d37b53dab 28 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260928180608-fd7d37b53dab 28 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260927211007-f5194dd7488c 27 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260927211007-f5194dd7488c 27 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260927125206-ab3562c9c96c 27 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260925180105-99714653c0d6 25 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260925180105-99714653c0d6 25 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260922013759-3edd0a00f854 22 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260922013759-3edd0a00f854 22 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260921192600-eabafa74076f 21 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260921192600-eabafa74076f 21 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260920214659-184b42a9325d 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260920092058-c9f490dd8b07 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260920092058-c9f490dd8b07 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.3-0.20260920090958-460c595a8fbd 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260920090058-846216e1bfe9 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260920054717-5567c3e0ed7d 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260920054717-5567c3e0ed7d 20 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260919170217-112e9dc6c2f6 19 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260919170217-112e9dc6c2f6 19 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.20.5-0.20260919090117-b029fcaadb5b 19 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260919084617-8e3f39832e55 19 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260918224116-9c72e7911ee3 18 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260918224116-9c72e7911ee3 18 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260917024615-c4973792a4c2 17 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260917024615-c4973792a4c2 17 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260916194713-3708acedabeb 16 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260915192411-095f4193cb5e 15 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260915192411-095f4193cb5e 15 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260915122112-0b9448974868 15 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.20.4 15 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260915113712-6687698f4e4c 15 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v1.21.0-beta.0.0.20260915113712-6687698f4e4c 15 Sep 2026 M2 U1 Apache-2.0 Yes Details →
v0.0.0-20260914004410-8ad5011ab6a5 14 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260914004410-8ad5011ab6a5 14 Sep 2026 M2 U1 — Yes Details →
v1.21.3-0.20260914004211-3921664ed8dd 14 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260913181610-4403a67fd303 13 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260913175713-784b4c971d58 13 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260912053607-9313ef502c74 12 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260912053607-9313ef502c74 12 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260912050707-e339aa21c59d 12 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260911183805-a53560bbf969 11 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260911183805-a53560bbf969 11 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260910155605-a1cfd3851954 10 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260910155605-a1cfd3851954 10 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260910144205-c4dd279c2fc5 10 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260910072404-922a06aa49ee 10 Sep 2026 M2 U1 — Yes Details →
v1.21.2 10 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260910060105-f2cafccba8ef 10 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260910060105-f2cafccba8ef 10 Sep 2026 M2 U1 — Yes Details →
v0.0.0-20260909145004-fe3cba75eebc 09 Sep 2026 M2 U1 — Yes Details →
v1.21.0-beta.0.0.20260909145004-fe3cba75eebc 09 Sep 2026 M2 U1 — Yes Details →
v1.21.2-0.20260909071303-5badcbde848b 09 Sep 2026 M2 U1 — Yes Details →

The newest 120 of 1,770 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 3
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 5 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/cert-manager/cert-manager

The 5 most severe of 5 vulnerabilities recorded for this package

Search all 5 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Denial-of-Service Vulnerability in cert-manager: Slow PEM Parsing 6.9 medium 1.12.14 20 Nov 2024
Denial of Service Vulnerability in cert-manager: DoS via Malicious DNS Responses 5.9 medium 1.18.5 02 Feb 2026
Potential DoS Vulnerability in cert-manager: CPU Exhaustion via Malicious PEM Inputs 4.4 medium 1.12.14 12 Dec 2024
Potential DoS Vulnerability in cert-manager: Slowdown from Malicious PEM Inputs N/A unrated 1.12.14 21 Nov 2024
CVE-2026-25518: cert-manager DoS via Specially Crafted DNS Response N/A unrated 1.18.5 19 Feb 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/cert-manager/cert-manager

Is github.com/cert-manager/cert-manager safe to use?

Vulert records 5 vulnerabilities for github.com/cert-manager/cert-manager in Go: 0 critical, 0 high, 3 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/cert-manager/cert-manager's Vulert package health score?

Vulert scores github.com/cert-manager/cert-manager 90/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/cert-manager/cert-manager affected?

Yes. v1.21.2, the version you would install today, has 3 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/cert-manager/cert-manager should I use?

v1.21.2 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/cert-manager/cert-manager have?

5 vulnerabilities are recorded for github.com/cert-manager/cert-manager in the Go ecosystem: 0 critical, 0 high, 3 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/cert-manager/cert-manager vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/cert-manager/cert-manager in the last 12 months, and the oldest entry in this database dates to 20 Nov 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/cert-manager/cert-manager are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/cert-manager/cert-manager for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/cert-manager/cert-manager version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.