The cert-manager Operator for Red Hat OpenShift (versions >=1.18.0 <=1.18.1) includes a vulnerability identified as CVE-2025-66418, stemming from the urllib3 Python library. This vulnerability allows a remote attacker to trigger a denial of service by exploiting an unbounded decompression chain in HTTP responses, causing excessive CPU and memory consumption. The vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Resource Shutdown or Release). The Red Hat advisory RHSA-2026:1176 references this and related CVEs but does not explicitly state a fixed version or patch availability. The operator's upgrade mechanism depends on the installation's approval policy; automatic upgrades occur if set, otherwise manual intervention is needed. The advisory recommends ensuring all prior errata are applied before upgrading.

Exploitation of this vulnerability leads to denial of service conditions by exhausting CPU and memory resources on the client system running the cert-manager Operator. This can cause the operator and potentially dependent services to become unresponsive, disrupting certificate management within the Kubernetes cluster. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

The vendor advisory states that if the cert-manager Operator's installation uses the default 'Automatic' approval policy, the operator will upgrade automatically to a fixed version when available, requiring no user action. For installations with a 'Manual' approval policy, administrators must manually approve the upgrade. Before upgrading, ensure all previously released errata relevant to the system are applied. Users should monitor the Red Hat advisory RHSA-2026:1176 and related documentation for updates on patch availability and upgrade instructions. No explicit patch version is currently provided, so checking the vendor advisory regularly is recommended.