{"id":"EUVD-2025-201293","revision":"c3226b3db6784034bc49820af6995af7","records":[{"revision":"c3226b3db6784034bc49820af6995af7","observedAt":"2026-11-01T01:15:14.762+00:00","statement":{"source":"euvd","id":"EUVD-2025-201293","aliases":["CVE-2025-66506","GHSA-f83f-xpx7-ffpw"],"title":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrus…","description":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201293","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 4, 2025, 10:04:41 PM","dateUpdated":"Dec 5, 2025, 3:32:25 PM"},"relatedAdvisories":[{"id":"RHSA-2026:2924","title":"Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-22772"]},{"id":"RHSA-2025:23204","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (CUDA)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-62593","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2025:23205","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:51033","title":"Red Hat Security Advisory: Red Hat OpenShift API for Data Protection","vulnerabilityIds":["CVE-2024-25621","CVE-2025-61726","CVE-2025-61728","CVE-2025-61729","CVE-2025-66506","CVE-2025-68121","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-33186","CVE-2026-33747","CVE-2026-33748","CVE-2026-33810","CVE-2026-33811","CVE-2026-34986","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-42306","CVE-2026-42499","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-53488","CVE-2026-53492"]},{"id":"RHSA-2026:2852","title":"Red Hat Security Advisory: OpenShift Security Profiles Operator bug fix and enhancement update","vulnerabilityIds":["CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:2350","title":"Red Hat Security Advisory: RHACS 4.9.3 security and bug fix update","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-58183","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564","CVE-2025-68428","CVE-2025-68973","CVE-2026-22029"]},{"id":"RHSA-2026:6166","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1","vulnerabilityIds":["CVE-2025-66506","CVE-2026-33022","CVE-2026-33211"]},{"id":"RHSA-2026:1049","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.0","vulnerabilityIds":["CVE-2025-66506"]},{"id":"WID-SEC-W-2026-0199","title":"Red Hat OpenShift Pipelines Operator (Fulcio): Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-66506"]},{"id":"RHSA-2026:3723","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4","vulnerabilityIds":["CVE-2025-66506"]},{"id":"RHSA-2026:37387","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-25621","CVE-2024-40635","CVE-2024-45310","CVE-2025-8766","CVE-2025-21613","CVE-2025-21614","CVE-2025-22870","CVE-2025-47911","CVE-2025-52881","CVE-2025-54410","CVE-2025-58058","CVE-2025-64329","CVE-2025-66506","CVE-2026-22772","CVE-2026-23831","CVE-2026-24117","CVE-2026-25680","CVE-2026-25681","CVE-2026-25934","CVE-2026-27136","CVE-2026-27141","CVE-2026-27903","CVE-2026-33540","CVE-2026-33747","CVE-2026-33748","CVE-2026-33814","CVE-2026-34986","CVE-2026-35172","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-39883","CVE-2026-41506","CVE-2026-41567","CVE-2026-41568","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-44740","CVE-2026-45571","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"RHSA-2026:3827","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044","CVE-2025-47913","CVE-2025-61729","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:3712","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4","vulnerabilityIds":["CVE-2024-37890","CVE-2025-6545","CVE-2025-6547","CVE-2025-9287","CVE-2025-9288","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:2136","title":"Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-47913","CVE-2025-61729","CVE-2025-66506","CVE-2026-22772"]},{"id":"RHSA-2026:2900","title":"Red Hat Security Advisory: Network Observability 1.11.0 for OpenShift","vulnerabilityIds":["CVE-2024-25621","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-52881","CVE-2025-58183","CVE-2025-64329","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-23745","CVE-2026-24049","CVE-2026-24842"]},{"id":"RHSA-2026:3461","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)","vulnerabilityIds":["CVE-2023-48022","CVE-2023-52355","CVE-2023-52356","CVE-2024-56433","CVE-2025-5318","CVE-2025-6242","CVE-2025-6965","CVE-2025-8176","CVE-2025-9230","CVE-2025-9714","CVE-2025-9900","CVE-2025-15467","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-53905","CVE-2025-53906","CVE-2025-59375","CVE-2025-59425","CVE-2025-61620","CVE-2025-62164","CVE-2025-62372","CVE-2025-62426","CVE-2025-62593","CVE-2025-62727","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-69223","CVE-2026-0994","CVE-2026-21441","CVE-2026-22773","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486","CVE-2026-24779","CVE-2026-25990"]},{"id":"RHSA-2026:4185","title":"Red Hat Security Advisory: Red Hat Quay 3.13.11","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-61729","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2144","title":"Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-61729","CVE-2025-64756","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66564","CVE-2026-21441","CVE-2026-22772","CVE-2026-22774","CVE-2026-22775","CVE-2026-23745","CVE-2026-23950"]},{"id":"RHSA-2026:3825","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3","vulnerabilityIds":["CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2026:41928","title":"Red Hat Security Advisory: Red Hat Migration Toolkit for Containers","vulnerabilityIds":["CVE-2025-7783","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-61726","CVE-2025-61729","CVE-2025-62718","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-68121","CVE-2025-69223","CVE-2025-69227","CVE-2025-69228","CVE-2026-4800","CVE-2026-6322","CVE-2026-9277","CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-21441","CVE-2026-22029","CVE-2026-23490","CVE-2026-23745","CVE-2026-25679","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-29063","CVE-2026-30922","CVE-2026-32280","CVE-2026-32281","CVE-2026-32283","CVE-2026-33186","CVE-2026-33810","CVE-2026-33811","CVE-2026-34986","CVE-2026-39820","CVE-2026-39821","CVE-2026-40895","CVE-2026-42264","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45736","CVE-2026-45822","CVE-2026-48779"]},{"id":"RHSA-2026:3462","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)","vulnerabilityIds":["CVE-2023-48022","CVE-2023-52355","CVE-2023-52356","CVE-2024-56433","CVE-2025-5318","CVE-2025-6242","CVE-2025-6965","CVE-2025-8176","CVE-2025-9230","CVE-2025-9714","CVE-2025-9900","CVE-2025-15467","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-53905","CVE-2025-53906","CVE-2025-59375","CVE-2025-59425","CVE-2025-61620","CVE-2025-62164","CVE-2025-62372","CVE-2025-62426","CVE-2025-62593","CVE-2025-62727","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-69223","CVE-2026-0994","CVE-2026-21441","CVE-2026-22773","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486","CVE-2026-24779","CVE-2026-25990"]},{"id":"RHSA-2025:23209","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (TPU)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:2568","title":"Red Hat Security Advisory: RHACS 4.9.3 security and bug fix update","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-58183","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564","CVE-2025-68428","CVE-2025-68973","CVE-2026-22029"]},{"id":"RHSA-2026:6170","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1","vulnerabilityIds":["CVE-2025-66506","CVE-2026-25639","CVE-2026-33022","CVE-2026-33211"]},{"id":"RHSA-2026:4215","title":"Red Hat Security Advisory: Red Hat Quay 3.14.6","vulnerabilityIds":["CVE-2022-30187","CVE-2024-34156","CVE-2024-47081","CVE-2025-12816","CVE-2025-15284","CVE-2025-45768","CVE-2025-47273","CVE-2025-47913","CVE-2025-50181","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-59420","CVE-2025-61729","CVE-2025-61920","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:1517","title":"Red Hat Security Advisory: RHACS 4.8.8 security and bug fix update","vulnerabilityIds":["CVE-2025-12816","CVE-2025-15284","CVE-2025-58183","CVE-2025-61729","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564","CVE-2025-68428","CVE-2025-68973","CVE-2026-22029"]},{"id":"RHSA-2026:2762","title":"Red Hat Security Advisory: Red Hat Quay 3.10.18","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-61729","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2754","title":"Red Hat Security Advisory: Red Hat Quay 3.9.18","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-52881","CVE-2025-61726","CVE-2025-61729","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66506","CVE-2026-24049"]},{"id":"RHSA-2026:1942","title":"Red Hat Security Advisory: Red Hat Quay 3.15.3","vulnerabilityIds":["CVE-2024-34156","CVE-2025-12816","CVE-2025-15284","CVE-2025-47907","CVE-2025-47913","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-59420","CVE-2025-61729","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:3710","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3","vulnerabilityIds":["CVE-2024-37890","CVE-2025-6545","CVE-2025-6547","CVE-2025-9287","CVE-2025-9288","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-66031","CVE-2025-66506","CVE-2025-66564"]},{"id":"RHSA-2025:23202","title":"Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-52565","CVE-2025-59375","CVE-2025-66506"]},{"id":"RHSA-2026:1730","title":"Red Hat Security Advisory: Red Hat Quay 3.12.13","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441"]},{"id":"RHSA-2025:23449","title":"Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)","vulnerabilityIds":["CVE-2025-9230","CVE-2025-9714","CVE-2025-22868","CVE-2025-22869","CVE-2025-47906","CVE-2025-52565","CVE-2025-59375","CVE-2025-62164","CVE-2025-62372","CVE-2025-66448","CVE-2025-66506"]},{"id":"RHSA-2026:3713","title":"Red Hat Security Advisory: RHOAI 3.3 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-25621","CVE-2025-6242","CVE-2025-12638","CVE-2025-12816","CVE-2025-14180","CVE-2025-14920","CVE-2025-14921","CVE-2025-14922","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-15284","CVE-2025-48956","CVE-2025-52881","CVE-2025-59425","CVE-2025-61726","CVE-2025-61729","CVE-2025-62164","CVE-2025-62593","CVE-2025-64756","CVE-2025-66031","CVE-2025-66034","CVE-2025-66416","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-67725","CVE-2025-67726","CVE-2025-68156","CVE-2025-68476","CVE-2025-68665","CVE-2025-69223","CVE-2025-69872","CVE-2026-0897","CVE-2026-1260","CVE-2026-21441","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486"]},{"id":"RHSA-2026:2922","title":"Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-47913","CVE-2025-61729","CVE-2025-65945","CVE-2025-66506","CVE-2026-22772"]},{"id":"RHSA-2026:2695","title":"Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-12805","CVE-2025-12816","CVE-2025-14925","CVE-2025-52881","CVE-2025-66034","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-68156","CVE-2025-68476","CVE-2025-69223","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2106","title":"Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-12805","CVE-2025-12816","CVE-2025-52881","CVE-2025-66034","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-67725","CVE-2025-67726","CVE-2025-68156","CVE-2025-68476","CVE-2025-69223","CVE-2026-21441","CVE-2026-24049"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201293","identifiers":["EUVD-2025-201293","CVE-2025-66506","GHSA-f83f-xpx7-ffpw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}