CVE-2025-66506
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-04

Last updated on: 2026-03-10

Assigner: GitHub, Inc.

Description
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-04
Last Modified
2026-03-10
Generated
2026-06-16
AI Q&A
2025-12-05
EPSS Evaluated
2026-06-15
NVD
CVE-2025-66506
EUVD
EUVD-2025-201293
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linuxfoundation fulcio to 1.8.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-405 The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Fulcio versions prior to 1.8.3, where the function identity.extractIssuerURL processes untrusted input by splitting it on periods. If a malicious OIDC identity token containing many period characters is provided, the function performs excessive memory allocations proportional to the input length, leading to a potential denial of service due to resource exhaustion. This issue was fixed in version 1.8.3.

Impact Analysis

The vulnerability can cause a denial of service (DoS) by exhausting system memory when processing specially crafted OIDC identity tokens with many period characters. This can disrupt the availability of the Fulcio certificate authority service, potentially preventing legitimate code signing certificate issuance.

Mitigation Strategies

Upgrade Fulcio to version 1.8.3 or later, as this version contains the fix for the vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart