{"id":"AZL-107195","summary":"CVE-2026-92543 affecting package cert-manager 1.12.15-14","details":"Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.","modified":"2026-10-11T14:17:15.988715543Z","published":"2026-10-07T17:17:02Z","upstream":["CVE-2026-92543"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92543"}],"affected":[{"package":{"name":"cert-manager","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/cert-manager"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.12.15-14"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107195.json"}}],"schema_version":"1.9.0"}