CVE-2025-61729 is a denial of service vulnerability in the golang crypto/x509 package used by the cert-manager Operator for Red Hat OpenShift. The flaw occurs during error string construction in the HostnameError.Error() function when handling a specially crafted certificate, causing unbounded string concatenation and excessive resource consumption. This can lead to degraded performance or denial of service. The cert-manager Operator for Red Hat OpenShift versions from 1.18.0 up to but not including 1.19.0 are affected. Red Hat's advisory (RHSA-2026:0981) details the issue and recommends upgrading the operator. The default installation policy is automatic upgrade, which will apply the fix when available. Manual upgrade requires user approval. No explicit fixed version is provided in the advisory, so users should monitor Red Hat errata for updates.

Successful exploitation of this vulnerability can cause excessive CPU and memory consumption on the affected system, resulting in denial of service conditions. There is no impact on confidentiality or integrity. The vulnerability affects availability by degrading system performance or causing service outages in the cert-manager Operator for Red Hat OpenShift.

Red Hat recommends ensuring that all previously released errata relevant to your system are applied before upgrading. If the cert-manager Operator approval policy is set to 'Automatic' (the default), the operator will upgrade automatically when a new version is released, requiring no further action. If the policy is set to 'Manual', users must manually approve the upgrade. Users should follow the official Red Hat documentation for cert-manager Operator upgrades at https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html. Monitor Red Hat advisories for the availability of fixed versions and apply updates promptly.