CVE-2025-66506

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a	Patch
https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:fulcio:*:*:*:*:*:*:*:*

History

18 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Fulcio es una autoridad de certificación de uso gratuito para emitir certificados de firma de código para una identidad de OpenID Connect (OIDC). Versiones anteriores a 1.8.3, la función identity.extractIssuerURL divide (mediante una llamada a strings.Split) su argumento (que son datos no confiables) por puntos. Como resultado, ante una solicitud maliciosa con un token de identidad OIDC (inválido) en la carga útil que contiene muchos caracteres de punto, una llamada a extractIssuerURL incurre en asignaciones del orden de O(n) bytes (donde n representa la longitud del argumento de la función), con un factor constante de aproximadamente 16. Esta vulnerabilidad se corrige en 1.8.3.

Information

Published : 2025-12-04 22:15

Updated : 2026-10-18 15:10

NVD link : CVE-2025-66506

Mitre link : CVE-2025-66506

CVE.ORG link : CVE-2025-66506

JSON object : View

Products Affected

linuxfoundation

fulcio

CWE

CWE-405

Asymmetric Resource Consumption (Amplification)

{"id": "CVE-2025-66506", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66506", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T15:32:15.086814Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sigstore", "product": "fulcio", "versions": [{"status": "affected", "version": "< 1.8.3"}]}]}], "published": "2025-12-04T22:15:49.503", "references": [{"url": "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-405"}]}], "descriptions": [{"lang": "en", "value": "Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3."}, {"lang": "es", "value": "Fulcio es una autoridad de certificaci\u00f3n de uso gratuito para emitir certificados de firma de c\u00f3digo para una identidad de OpenID Connect (OIDC). Versiones anteriores a 1.8.3, la funci\u00f3n identity.extractIssuerURL divide (mediante una llamada a strings.Split) su argumento (que son datos no confiables) por puntos. Como resultado, ante una solicitud maliciosa con un token de identidad OIDC (inv\u00e1lido) en la carga \u00fatil que contiene muchos caracteres de punto, una llamada a extractIssuerURL incurre en asignaciones del orden de O(n) bytes (donde n representa la longitud del argumento de la funci\u00f3n), con un factor constante de aproximadamente 16. Esta vulnerabilidad se corrige en 1.8.3."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:fulcio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4901884-0820-47DE-B4A7-E79A053D360D", "versionEndExcluding": "1.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}