CVE-2025-66506: CWE-405: Asymmetric Resource Consumption (Amplification) in sigstore fulcio
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
CVE-2025-66506: CWE-405: Asymmetric Resource Consumption (Amplification) in sigstore fulcio
Description
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2025-12-03T15:12:22.978Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 693209ac2bd9ee5f78fe683e
Added to database: 12/4/2025, 10:22:36 PM
Last updated: 12/4/2025, 10:22:39 PM
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
CVE-2025-1547: CWE-121 Stack-based Buffer Overflow in WatchGuard Fireware OS
HighCVE-2025-10285: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in silabs.com Simplicity Studio V6
HighCVE-2025-1910: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in WatchGuard Mobile VPN with SSL Client
MediumCVE-2025-12986: CWE-410 Insufficient Resource Pool in silabs.com Gecko SDK
MediumCVE-2025-53704: CWE-640 in MAXHUB Pivot client application
HighActions
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.