PT-2025-49168 · Fulcio+1 · Fulcio+1

Published 2025-01-01 · Updated 2026-05-18 · CVE-2025-66506

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fulcio versions prior to 1.8.3

Description Fulcio is a certificate authority for issuing code signing certificates for OpenID Connect (OIDC) identity. The identity.extractIssuerURL function splits its input, which is untrusted data, on periods. A malicious request with a large number of period characters in the OIDC identity token payload can cause the function to allocate memory proportional to the input length, potentially leading to excessive memory consumption.

Recommendations Update to version 1.8.3 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-405

Related Identifiers

CLEANSTART-2026-HF07497

CVE-2025-66506

ECHO-8C75-2B8F-1138

GHSA-F83F-XPX7-FFPW

GO-2025-4193

SUSE-SU-2025:4395-1

Affected Products

Debian

Fulcio

References · 123

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66506.json · Exploit
• https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw · Vendor Advisory
• https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a · Patch
• https://cve.org/CVERecord?id=CVE-2025-66506 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-HF07497 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f83f-xpx7-ffpw · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22703 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66506 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note