CVE-2025-66506: Fulcio allocates excessive memory during token parsing
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
Other sources
Function identity.extractIssuerURL currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.
As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)
Details See identity.extractIssuerURL
Impact Excessive memory allocation
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/sigstore/fulcioto a version that resolves this vulnerability.Fixed in 1.8.3 - Upgrade
Upgrade
fulcioto a version that resolves this vulnerability.Fixed in 1.8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66506?
CVE-2025-66506 is classified with a critical severity due to its potential impact on security through untrusted data handling.
How do I fix CVE-2025-66506?
To fix CVE-2025-66506, upgrade Fulcio to version 1.8.3 or later where the vulnerability has been addressed.
What systems are affected by CVE-2025-66506?
CVE-2025-66506 affects Fulcio versions prior to 1.8.3.
What type of vulnerability is CVE-2025-66506?
CVE-2025-66506 is a code injection vulnerability that arises from improper handling of untrusted input.
Can CVE-2025-66506 lead to unauthorized access?
Yes, CVE-2025-66506 can lead to unauthorized access by allowing attackers to manipulate the issuer URL in the system.