{"id":"GHSA-f83f-xpx7-ffpw","revision":"c7d372928bdc4c409333ce7f6601b2ad","records":[{"revision":"c7d372928bdc4c409333ce7f6601b2ad","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-f83f-xpx7-ffpw","aliases":["CVE-2025-66506","GO-2025-4193"],"title":"Fulcio allocates excessive memory during token parsing","description":"Function [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.\n\nAs a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to `extractIssuerURL` incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)\n\nDetails\nSee [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45)\n\nImpact\nExcessive memory allocation","state":0,"publishedAt":"2025-12-05T18:18:26+00:00","modifiedAt":"2026-09-10T03:50:58.5587122+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/fulcio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://nvd.nist.gov/vuln/detail/CVE-2025-66506","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a","https://github.com/sigstore/fulcio"],"sourceUrl":"https://github.com/advisories/GHSA-f83f-xpx7-ffpw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f83f-xpx7-ffpw","identifiers":["GHSA-f83f-xpx7-ffpw","CVE-2025-66506","GO-2025-4193"]},"retained":false,"historicalAffected":[]}],"coverage":[]}