Capsule Security Advisory: Stale Regex Validation Bug in hostnameRegexHandler.OnUpdate

The projectcapsule/capsule team has disclosed a medium-severity security issue in version 2026-09-18, as detailed in the GitHub Security Advisory database. The bug resides in the `hostnameRegexHandler.OnUpdate` webhook, which incorrectly validates the old Tenant object's `AllowedHostnames.Regex` instead of the new one being submitted during updates. This parameter order mismatch allows malformed regex patterns to bypass admission validation and be persisted to etcd. Consequently, subsequent Ingress operations within the affected tenant may fail due to a Denial of Service caused by the invalid regex.

Operators should carefully review their current configurations for `AllowedHostnames.Regex` in Tenant objects before upgrading to ensure no invalid regex patterns are present. Additionally, they should monitor ingress-related operations for any unexpected failures post-upgrade. This issue highlights the importance of validating webhook parameter handling in custom admission controllers, as similar bugs could lead to silent persistence of invalid configurations across other projects.