Fulcio allocates excessive memory during token parsing

CAO 7.5CVE-2025-66506 · GHSA-f83f-xpx7-ffpw · GO-2025-4193 · Công bố 04/12/2025 · cập nhật 18/10/2026

Tóm tắt nhanh

CVE-2025-66506 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/sigstore/fulcio, fulcio (linuxfoundation).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.21%, cao hơn 11.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.8.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/sigstore/fulcio Go	`< 1.8.3`	`1.8.3`
fulcio linuxfoundation	`< 1.8.3`	`1.8.3`

Mô tả

Function identity.extractIssuerURL currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)

Details See identity.extractIssuerURL

Impact Excessive memory allocation

Mô tả của NVD

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.