CVE-2025-12401: 
WordPress vulnerability analysis and mitigation

A vulnerability (CVE-2024-12401) was discovered in the cert-manager package that allows attackers to create a denial-of-service condition. The vulnerability was disclosed on December 12, 2024, and affects the cert-manager controller pod functionality (NVD).

The vulnerability is classified as CWE-20 (Improper Input Validation) with a CVSS v3.1 base score of 4.4 (MEDIUM). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requires high privileges (PR:H), no user interaction (UI:N), has an unchanged scope (S:U), and can result in high availability impact (A:H) while having no impact on confidentiality or integrity (NVD).

When exploited, this vulnerability allows an attacker who can modify PEM data that the cert-manager reads (for example, in a Secret resource) to consume large amounts of CPU in the cert-manager controller pod. This can effectively create a denial-of-service (DoS) condition for the cert-manager in the cluster (NVD).

Multiple pull requests have been created to address this vulnerability, as evidenced by references to GitHub pull requests 7400, 7401, 7402, and 7403 (NVD).