CVE-2025-66506Published

Fulcio allocates excessive memory during token parsing

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2025-66506

Published

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

Source published: 4 Dec 2025 22:04:41 UTC
Source modified: 5 Dec 2025 15:32:25 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2025-201293

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Dec 4, 2025, 10:04:41 PM

dateUpdated: Dec 5, 2025, 3:32:25 PM

37 related source bulletins · separate from aliases

RHSA-2026:2924: Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release

CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441 · CVE-2026-22772

RHSA-2025:23204: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (CUDA)

CVE-2025-9230 · CVE-2025-9714 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-52565 · CVE-2025-59375 · CVE-2025-62164 · CVE-2025-62372 · CVE-2025-62593 · CVE-2025-66448 · CVE-2025-66506

RHSA-2025:23205: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)

CVE-2025-9230 · CVE-2025-9714 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-47906 · CVE-2025-52565 · CVE-2025-59375 · CVE-2025-62164 · CVE-2025-62372 · CVE-2025-66448 · CVE-2025-66506

RHSA-2026:51033: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

CVE-2024-25621 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-66506 · CVE-2025-68121 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-33186 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-34986 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39835 · CVE-2026-42306 · CVE-2026-42499 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-53488 · CVE-2026-53492

RHSA-2026:2852: Red Hat Security Advisory: OpenShift Security Profiles Operator bug fix and enhancement update

CVE-2025-66506 · CVE-2025-66564

RHSA-2026:2350: Red Hat Security Advisory: RHACS 4.9.3 security and bug fix update

CVE-2025-12816 · CVE-2025-15284 · CVE-2025-58183 · CVE-2025-66031 · CVE-2025-66506 · CVE-2025-66564 · CVE-2025-68428 · CVE-2025-68973 · CVE-2026-22029

RHSA-2026:6166: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1

CVE-2025-66506 · CVE-2026-33022 · CVE-2026-33211

RHSA-2026:1049: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.0

CVE-2025-66506

WID-SEC-W-2026-0199: Red Hat OpenShift Pipelines Operator (Fulcio): Schwachstelle ermöglicht Denial of Service

CVE-2025-66506

RHSA-2026:3723: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4

CVE-2025-66506

RHSA-2026:37387: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update

CVE-2024-25621 · CVE-2024-40635 · CVE-2024-45310 · CVE-2025-8766 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22870 · CVE-2025-47911 · CVE-2025-52881 · CVE-2025-54410 · CVE-2025-58058 · CVE-2025-64329 · CVE-2025-66506 · CVE-2026-22772 · CVE-2026-23831 · CVE-2026-24117 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-25934 · CVE-2026-27136 · CVE-2026-27141 · CVE-2026-27903 · CVE-2026-33540 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35172 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-39883 · CVE-2026-41506 · CVE-2026-41567 · CVE-2026-41568 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-45571 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

RHSA-2026:3827: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3

CVE-2025-11621 · CVE-2025-12044 · CVE-2025-47913 · CVE-2025-61729 · CVE-2025-66506 · CVE-2025-66564

RHSA-2026:3712: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.4

CVE-2024-37890 · CVE-2025-6545 · CVE-2025-6547 · CVE-2025-9287 · CVE-2025-9288 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66031 · CVE-2025-66506 · CVE-2025-66564

RHSA-2026:2136: Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

CVE-2025-47913 · CVE-2025-61729 · CVE-2025-66506 · CVE-2026-22772

RHSA-2026:2900: Red Hat Security Advisory: Network Observability 1.11.0 for OpenShift

CVE-2024-25621 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-52881 · CVE-2025-58183 · CVE-2025-64329 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441 · CVE-2026-23745 · CVE-2026-24049 · CVE-2026-24842

RHSA-2026:3461: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)

CVE-2023-48022 · CVE-2023-52355 · CVE-2023-52356 · CVE-2024-56433 · CVE-2025-5318 · CVE-2025-6242 · CVE-2025-6965 · CVE-2025-8176 · CVE-2025-9230 · CVE-2025-9714 · CVE-2025-9900 · CVE-2025-15467 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-47906 · CVE-2025-52565 · CVE-2025-53905 · CVE-2025-53906 · CVE-2025-59375 · CVE-2025-59425 · CVE-2025-61620 · CVE-2025-62164 · CVE-2025-62372 · CVE-2025-62426 · CVE-2025-62593 · CVE-2025-62727 · CVE-2025-66418 · CVE-2025-66448 · CVE-2025-66471 · CVE-2025-66506 · CVE-2025-69223 · CVE-2026-0994 · CVE-2026-21441 · CVE-2026-22773 · CVE-2026-22778 · CVE-2026-22807 · CVE-2026-24049 · CVE-2026-24486 · CVE-2026-24779 · CVE-2026-25990

RHSA-2026:4185: Red Hat Security Advisory: Red Hat Quay 3.13.11

CVE-2025-12816 · CVE-2025-15284 · CVE-2025-52881 · CVE-2025-61729 · CVE-2025-65945 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441 · CVE-2026-24049

RHSA-2026:2144: Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

CVE-2025-61729 · CVE-2025-64756 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2025-66564 · CVE-2026-21441 · CVE-2026-22772 · CVE-2026-22774 · CVE-2026-22775 · CVE-2026-23745 · CVE-2026-23950

RHSA-2026:3825: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66506 · CVE-2025-66564

RHSA-2026:41928: Red Hat Security Advisory: Red Hat Migration Toolkit for Containers

CVE-2025-7783 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-52881 · CVE-2025-58183 · CVE-2025-58754 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-62718 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2025-68121 · CVE-2025-69223 · CVE-2025-69227 · CVE-2025-69228 · CVE-2026-4800 · CVE-2026-6322 · CVE-2026-9277 · CVE-2026-9595 · CVE-2026-12143 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-21441 · CVE-2026-22029 · CVE-2026-23490 · CVE-2026-23745 · CVE-2026-25679 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27137 · CVE-2026-29063 · CVE-2026-30922 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32283 · CVE-2026-33186 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-34986 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-40895 · CVE-2026-42264 · CVE-2026-42338 · CVE-2026-42499 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-45736 · CVE-2026-45822 · CVE-2026-48779

RHSA-2026:3462: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)

RHSA-2025:23209: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (TPU)

CVE-2025-9230 · CVE-2025-9714 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-52565 · CVE-2025-59375 · CVE-2025-62164 · CVE-2025-62372 · CVE-2025-66448 · CVE-2025-66506

RHSA-2026:2568: Red Hat Security Advisory: RHACS 4.9.3 security and bug fix update

CVE-2025-12816 · CVE-2025-15284 · CVE-2025-58183 · CVE-2025-66031 · CVE-2025-66506 · CVE-2025-66564 · CVE-2025-68428 · CVE-2025-68973 · CVE-2026-22029

RHSA-2026:6170: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1

CVE-2025-66506 · CVE-2026-25639 · CVE-2026-33022 · CVE-2026-33211

RHSA-2026:4215: Red Hat Security Advisory: Red Hat Quay 3.14.6

CVE-2022-30187 · CVE-2024-34156 · CVE-2024-47081 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-45768 · CVE-2025-47273 · CVE-2025-47913 · CVE-2025-50181 · CVE-2025-52881 · CVE-2025-58183 · CVE-2025-58754 · CVE-2025-59420 · CVE-2025-61729 · CVE-2025-61920 · CVE-2025-65945 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441 · CVE-2026-24049

RHSA-2026:1517: Red Hat Security Advisory: RHACS 4.8.8 security and bug fix update

CVE-2025-12816 · CVE-2025-15284 · CVE-2025-58183 · CVE-2025-61729 · CVE-2025-66031 · CVE-2025-66506 · CVE-2025-66564 · CVE-2025-68428 · CVE-2025-68973 · CVE-2026-22029

RHSA-2026:2762: Red Hat Security Advisory: Red Hat Quay 3.10.18

CVE-2024-34156 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-52881 · CVE-2025-61729 · CVE-2025-65945 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441 · CVE-2026-24049

RHSA-2026:2754: Red Hat Security Advisory: Red Hat Quay 3.9.18

CVE-2024-34156 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-12816 · CVE-2025-52881 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-65945 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66506 · CVE-2026-24049

RHSA-2026:1942: Red Hat Security Advisory: Red Hat Quay 3.15.3

CVE-2024-34156 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-47907 · CVE-2025-47913 · CVE-2025-52881 · CVE-2025-58183 · CVE-2025-58754 · CVE-2025-59420 · CVE-2025-61729 · CVE-2025-65945 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441 · CVE-2026-24049

RHSA-2026:3710: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3

CVE-2024-37890 · CVE-2025-6545 · CVE-2025-6547 · CVE-2025-9287 · CVE-2025-9288 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66031 · CVE-2025-66506 · CVE-2025-66564

RHSA-2025:23202: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)

CVE-2025-9230 · CVE-2025-9714 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-52565 · CVE-2025-59375 · CVE-2025-66506

RHSA-2026:1730: Red Hat Security Advisory: Red Hat Quay 3.12.13

CVE-2024-34156 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-52881 · CVE-2025-65945 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2026-21441

RHSA-2025:23449: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.5 (ROCm)

CVE-2025-9230 · CVE-2025-9714 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-47906 · CVE-2025-52565 · CVE-2025-59375 · CVE-2025-62164 · CVE-2025-62372 · CVE-2025-66448 · CVE-2025-66506

RHSA-2026:3713: Red Hat Security Advisory: RHOAI 3.3 - Red Hat OpenShift AI

CVE-2024-25621 · CVE-2025-6242 · CVE-2025-12638 · CVE-2025-12816 · CVE-2025-14180 · CVE-2025-14920 · CVE-2025-14921 · CVE-2025-14922 · CVE-2025-14924 · CVE-2025-14925 · CVE-2025-14926 · CVE-2025-14927 · CVE-2025-14928 · CVE-2025-14929 · CVE-2025-14930 · CVE-2025-15284 · CVE-2025-48956 · CVE-2025-52881 · CVE-2025-59425 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-62164 · CVE-2025-62593 · CVE-2025-64756 · CVE-2025-66031 · CVE-2025-66034 · CVE-2025-66416 · CVE-2025-66418 · CVE-2025-66448 · CVE-2025-66471 · CVE-2025-66506 · CVE-2025-66626 · CVE-2025-67725 · CVE-2025-67726 · CVE-2025-68156 · CVE-2025-68476 · CVE-2025-68665 · CVE-2025-69223 · CVE-2025-69872 · CVE-2026-0897 · CVE-2026-1260 · CVE-2026-21441 · CVE-2026-22778 · CVE-2026-22807 · CVE-2026-24049 · CVE-2026-24486

RHSA-2026:2922: Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release

CVE-2025-47913 · CVE-2025-61729 · CVE-2025-65945 · CVE-2025-66506 · CVE-2026-22772

RHSA-2026:2695: Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI

CVE-2025-12805 · CVE-2025-12816 · CVE-2025-14925 · CVE-2025-52881 · CVE-2025-66034 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2025-66626 · CVE-2025-68156 · CVE-2025-68476 · CVE-2025-69223 · CVE-2026-21441 · CVE-2026-24049

RHSA-2026:2106: Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI

CVE-2025-12805 · CVE-2025-12816 · CVE-2025-52881 · CVE-2025-66034 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-66506 · CVE-2025-66626 · CVE-2025-67725 · CVE-2025-67726 · CVE-2025-68156 · CVE-2025-68476 · CVE-2025-69223 · CVE-2026-21441 · CVE-2026-24049

Source published: Dec 4, 2025, 10:04:41 PM (timezone not stated)
Source modified: Dec 5, 2025, 3:32:25 PM (timezone not stated)
Observed here: 9 Nov 2026 04:09:12 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2025-66506

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-405

Original publisher date fields

published: 2025-12-04T22:15:49.503

lastModified: 2026-10-18T15:10:00.097

1 source CPE criteria · context only

cpe:2.3:a:linuxfoundation:fulcio:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 4 Dec 2025 22:15:49 UTC
Source modified: 18 Oct 2026 15:10:00 UTC
Observed here: 25 Oct 2026 03:17:36 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-f83f-xpx7-ffpw

Published

Function [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to `extractIssuerURL` incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html) Details See [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) Impact Excessive memory allocation

Source published: 5 Dec 2025 18:18:26 UTC
Source modified: 10 Sep 2026 03:50:58 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH

osv · GO-2025-4193

Published

Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio

Source published: 8 Dec 2025 21:31:36 UTC
Source modified: 4 Feb 2026 03:55:44 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.