{"id":"CVE-2025-66506","revision":null,"records":[{"revision":"2e3da367f8d249d7882d3ccf381a8773","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-66506","aliases":[],"title":"Fulcio allocates excessive memory during token parsing","description":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":"2025-12-04T22:04:41.637+00:00","modifiedAt":"2025-12-05T15:32:25.591+00:00","affected":[{"ecosystem":"Vendor product","name":"fulcio","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sigstore\",\n                    \"product\": \"fulcio\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.8.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-66506","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-66506","identifiers":["CVE-2025-66506"]},"retained":false,"historicalAffected":[]},{"revision":"20900ee9291841cabd4d6ea95e87b9f1","observedAt":"2026-11-09T04:09:12.429+00:00","statement":{"source":"euvd","id":"EUVD-2025-201293","aliases":["CVE-2025-66506","GHSA-f83f-xpx7-ffpw"],"title":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrus…","description":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201293","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 4, 2025, 10:04:41 PM","dateUpdated":"Dec 5, 2025, 3:32:25 PM"},"relatedAdvisories":[{"id":"RHSA-2026:2924","title":"Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-22772"]},{"id":"RHSA-2025:23204","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (CUDA)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-62593","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2025:23205","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:51033","title":"Red Hat Security Advisory: Red Hat OpenShift API for Data Protection","vulnerabilityIds":["CVE-2024-25621","CVE-2025-61726","CVE-2025-61728","CVE-2025-61729","CVE-2025-66506","CVE-2025-68121","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-33186","CVE-2026-33747","CVE-2026-33748","CVE-2026-33810","CVE-2026-33811","CVE-2026-34986","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-42306","CVE-2026-42499","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-53488","CVE-2026-53492"]},{"id":"RHSA-2026:2852","title":"Red Hat Security Advisory: OpenShift Security Profiles Operator bug fix and enhancement update","vulnerabilityIds":["CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:2350","title":"Red Hat Security Advisory: RHACS 4.9.3 security and bug fix update","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-58183","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564","CVE-2025-68428","CVE-2025-68973","CVE-2026-22029"]},{"id":"RHSA-2026:6166","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1","vulnerabilityIds":["CVE-2025-66506","CVE-2026-33022","CVE-2026-33211"]},{"id":"RHSA-2026:1049","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.0","vulnerabilityIds":["CVE-2025-66506"]},{"id":"WID-SEC-W-2026-0199","title":"Red Hat OpenShift Pipelines Operator (Fulcio): Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-66506"]},{"id":"RHSA-2026:3723","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4","vulnerabilityIds":["CVE-2025-66506"]},{"id":"RHSA-2026:37387","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-25621","CVE-2024-40635","CVE-2024-45310","CVE-2025-8766","CVE-2025-21613","CVE-2025-21614","CVE-2025-22870","CVE-2025-47911","CVE-2025-52881","CVE-2025-54410","CVE-2025-58058","CVE-2025-64329","CVE-2025-66506","CVE-2026-22772","CVE-2026-23831","CVE-2026-24117","CVE-2026-25680","CVE-2026-25681","CVE-2026-25934","CVE-2026-27136","CVE-2026-27141","CVE-2026-27903","CVE-2026-33540","CVE-2026-33747","CVE-2026-33748","CVE-2026-33814","CVE-2026-34986","CVE-2026-35172","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-39883","CVE-2026-41506","CVE-2026-41567","CVE-2026-41568","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-44740","CVE-2026-45571","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"RHSA-2026:3827","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044","CVE-2025-47913","CVE-2025-61729","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:3712","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4","vulnerabilityIds":["CVE-2024-37890","CVE-2025-6545","CVE-2025-6547","CVE-2025-9287","CVE-2025-9288","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:2136","title":"Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-47913","CVE-2025-61729","CVE-2025-66506","CVE-2026-22772"]},{"id":"RHSA-2026:2900","title":"Red Hat Security Advisory: Network Observability 1.11.0 for OpenShift","vulnerabilityIds":["CVE-2024-25621","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-52881","CVE-2025-58183","CVE-2025-64329","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-23745","CVE-2026-24049","CVE-2026-24842"]},{"id":"RHSA-2026:3461","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)","vulnerabilityIds":["CVE-2023-48022","CVE-2023-52355","CVE-2023-52356","CVE-2024-56433","CVE-2025-5318","CVE-2025-6242","CVE-2025-6965","CVE-2025-8176","CVE-2025-9230","CVE-2025-9714","CVE-2025-9900","CVE-2025-15467","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-53905","CVE-2025-53906","CVE-2025-59375","CVE-2025-59425","CVE-2025-61620","CVE-2025-62164","CVE-2025-62372","CVE-2025-62426","CVE-2025-62593","CVE-2025-62727","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-69223","CVE-2026-0994","CVE-2026-21441","CVE-2026-22773","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486","CVE-2026-24779","CVE-2026-25990"]},{"id":"RHSA-2026:4185","title":"Red Hat Security Advisory: Red Hat Quay 3.13.11","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-61729","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2144","title":"Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-61729","CVE-2025-64756","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66564","CVE-2026-21441","CVE-2026-22772","CVE-2026-22774","CVE-2026-22775","CVE-2026-23745","CVE-2026-23950"]},{"id":"RHSA-2026:3825","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3","vulnerabilityIds":["CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:41928","title":"Red Hat Security Advisory: Red Hat Migration Toolkit for Containers","vulnerabilityIds":["CVE-2025-7783","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-61726","CVE-2025-61729","CVE-2025-62718","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-68121","CVE-2025-69223","CVE-2025-69227","CVE-2025-69228","CVE-2026-4800","CVE-2026-6322","CVE-2026-9277","CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-21441","CVE-2026-22029","CVE-2026-23490","CVE-2026-23745","CVE-2026-25679","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-29063","CVE-2026-30922","CVE-2026-32280","CVE-2026-32281","CVE-2026-32283","CVE-2026-33186","CVE-2026-33810","CVE-2026-33811","CVE-2026-34986","CVE-2026-39820","CVE-2026-39821","CVE-2026-40895","CVE-2026-42264","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45736","CVE-2026-45822","CVE-2026-48779"]},{"id":"RHSA-2026:3462","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)","vulnerabilityIds":["CVE-2023-48022","CVE-2023-52355","CVE-2023-52356","CVE-2024-56433","CVE-2025-5318","CVE-2025-6242","CVE-2025-6965","CVE-2025-8176","CVE-2025-9230","CVE-2025-9714","CVE-2025-9900","CVE-2025-15467","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-53905","CVE-2025-53906","CVE-2025-59375","CVE-2025-59425","CVE-2025-61620","CVE-2025-62164","CVE-2025-62372","CVE-2025-62426","CVE-2025-62593","CVE-2025-62727","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-69223","CVE-2026-0994","CVE-2026-21441","CVE-2026-22773","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486","CVE-2026-24779","CVE-2026-25990"]},{"id":"RHSA-2025:23209","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (TPU)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:2568","title":"Red Hat Security Advisory: RHACS 4.9.3 security and bug fix update","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-58183","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564","CVE-2025-68428","CVE-2025-68973","CVE-2026-22029"]},{"id":"RHSA-2026:6170","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1","vulnerabilityIds":["CVE-2025-66506","CVE-2026-25639","CVE-2026-33022","CVE-2026-33211"]},{"id":"RHSA-2026:4215","title":"Red Hat Security Advisory: Red Hat Quay 3.14.6","vulnerabilityIds":["CVE-2022-30187","CVE-2024-34156","CVE-2024-47081","CVE-2025-12816","CVE-2025-15284","CVE-2025-45768","CVE-2025-47273","CVE-2025-47913","CVE-2025-50181","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-59420","CVE-2025-61729","CVE-2025-61920","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:1517","title":"Red Hat Security Advisory: RHACS 4.8.8 security and bug fix update","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-58183","CVE-2025-61729","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564","CVE-2025-68428","CVE-2025-68973","CVE-2026-22029"]},{"id":"RHSA-2026:2762","title":"Red Hat Security Advisory: Red Hat Quay 3.10.18","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-61729","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2754","title":"Red Hat Security Advisory: Red Hat Quay 3.9.18","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-52881","CVE-2025-61726","CVE-2025-61729","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66506","CVE-2026-24049"]},{"id":"RHSA-2026:1942","title":"Red Hat Security Advisory: Red Hat Quay 3.15.3","vulnerabilityIds":["CVE-2024-34156","CVE-2025-12816","CVE-2025-15284","CVE-2025-47907","CVE-2025-47913","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-59420","CVE-2025-61729","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:3710","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3","vulnerabilityIds":["CVE-2024-37890","CVE-2025-6545","CVE-2025-6547","CVE-2025-9287","CVE-2025-9288","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2025:23202","title":"Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-52565","CVE-2025-59375","CVE-2025-66506"]},{"id":"RHSA-2026:1730","title":"Red Hat Security Advisory: Red Hat Quay 3.12.13","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441"]},{"id":"RHSA-2025:23449","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:3713","title":"Red Hat Security Advisory: RHOAI 3.3 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-25621","CVE-2025-6242","CVE-2025-12638","CVE-2025-12816","CVE-2025-14180","CVE-2025-14920","CVE-2025-14921","CVE-2025-14922","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-15284","CVE-2025-48956","CVE-2025-52881","CVE-2025-59425","CVE-2025-61726","CVE-2025-61729","CVE-2025-62164","CVE-2025-62593","CVE-2025-64756","CVE-2025-66031","CVE-2025-66034","CVE-2025-66416","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-67725","CVE-2025-67726","CVE-2025-68156","CVE-2025-68476","CVE-2025-68665","CVE-2025-69223","CVE-2025-69872","CVE-2026-0897","CVE-2026-1260","CVE-2026-21441","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486"]},{"id":"RHSA-2026:2922","title":"Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-47913","CVE-2025-61729","CVE-2025-65945","CVE-2025-66506","CVE-2026-22772"]},{"id":"RHSA-2026:2695","title":"Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-12805","CVE-2025-12816","CVE-2025-14925","CVE-2025-52881","CVE-2025-66034","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-68156","CVE-2025-68476","CVE-2025-69223","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2106","title":"Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-12805","CVE-2025-12816","CVE-2025-52881","CVE-2025-66034","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-67725","CVE-2025-67726","CVE-2025-68156","CVE-2025-68476","CVE-2025-69223","CVE-2026-21441","CVE-2026-24049"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201293","identifiers":["EUVD-2025-201293","CVE-2025-66506","GHSA-f83f-xpx7-ffpw"]},"retained":false,"historicalAffected":[]},{"revision":"7d270275e52843b282268e514a9e6626","observedAt":"2026-10-25T03:17:36.152+00:00","statement":{"source":"nvd","id":"CVE-2025-66506","aliases":[],"title":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrus…","description":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":"2025-12-04T22:15:49.503+00:00","modifiedAt":"2026-10-18T15:10:00.097+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a","https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66506","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-405"],"productCriteria":["cpe:2.3:a:linuxfoundation:fulcio:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2025-12-04T22:15:49.503","lastModified":"2026-10-18T15:10:00.097"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-66506","identifiers":["CVE-2025-66506"]},"retained":false,"historicalAffected":[]},{"revision":"c7d372928bdc4c409333ce7f6601b2ad","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-f83f-xpx7-ffpw","aliases":["CVE-2025-66506","GO-2025-4193"],"title":"Fulcio allocates excessive memory during token parsing","description":"Function [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.\n\nAs a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to `extractIssuerURL` incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)\n\nDetails\nSee [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45)\n\nImpact\nExcessive memory allocation","state":0,"publishedAt":"2025-12-05T18:18:26+00:00","modifiedAt":"2026-09-10T03:50:58.5587122+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/fulcio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://nvd.nist.gov/vuln/detail/CVE-2025-66506","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a","https://github.com/sigstore/fulcio"],"sourceUrl":"https://github.com/advisories/GHSA-f83f-xpx7-ffpw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f83f-xpx7-ffpw","identifiers":["GHSA-f83f-xpx7-ffpw","CVE-2025-66506","GO-2025-4193"]},"retained":false,"historicalAffected":[]},{"revision":"ffbf84c15f1f4e738c86fdf38394065d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4193","aliases":["CVE-2025-66506","GHSA-f83f-xpx7-ffpw"],"title":"Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio","description":"Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio","state":0,"publishedAt":"2025-12-08T21:31:36+00:00","modifiedAt":"2026-02-04T03:55:44.700916+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/fulcio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://nvd.nist.gov/vuln/detail/CVE-2025-66506","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4193","license":"OSV · upstream source license applies","key":"osv:GO-2025-4193","identifiers":["GO-2025-4193","CVE-2025-66506","GHSA-f83f-xpx7-ffpw"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T06:02:15.5744295+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T06:02:15.5744295+00:00","lastSuccessAt":"2026-11-09T06:02:15.8100724+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.8100756+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-61bf15172f364246efc204ad9b25e3f89710939e13c23b3efb3d009b5fdad808","complete":true,"records":421290,"lastAttemptAt":"2026-11-09T06:02:14.4940664+00:00","lastSuccessAt":"2026-11-09T05:02:14.5253969+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-09T05:02:14.5383867+00:00","snapshotPublishedAt":"2026-11-09T04:29:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-52f0bd58a8564ba89a1952b43ef3bc92","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T06:14:09.0160642+00:00","lastSuccessAt":"2026-11-09T06:14:09.013+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T06:14:09.013+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13674,"expectedIdentifiers":13706,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T06:02:15.5744295+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T06:02:15.5744295+00:00","lastSuccessAt":"2026-11-09T06:02:15.8108397+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.81084+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5a44a451442747cb81d83104fe1e7771","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T06:02:16.371904+00:00","lastSuccessAt":"2026-11-09T02:08:52.274+00:00","error":null,"lastVerifiedAt":"2026-11-09T02:08:52.274+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T06:02:15.5156789+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.5156789+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T06:02:14.6970768+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:14.6970768+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T06:02:15.5284383+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.5284383+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-6a1c845b1938b1aa788f0e95c9ac8a8d5a1f07caed5d155840b0616b548c1455","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T06:02:15.4064738+00:00","lastSuccessAt":"2026-11-09T04:03:49.859595+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.4064738+00:00","snapshotPublishedAt":"2026-11-09T03:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}