CVE-2025-66506 is a denial of service vulnerability in Fulcio, a certificate authority used by Red Hat products for code signing. The vulnerability arises from excessive memory allocation when processing a specially crafted OpenID Connect (OIDC) token containing many period characters, leading to resource exhaustion and potential service unavailability. This affects Red Hat products that utilize Fulcio, including the OpenShift Security Profiles Operator. Red Hat released version 0.10.0 of the Security Profiles Operator to fix this and other related bugs. The advisory references multiple bug fixes related to pod startup failures and container creation errors. The vulnerability is classified under CWE-405 (Asymmetric Resource Consumption). Red Hat rates this vulnerability as important and assigns a CVSS base score of 7.5 (high) for their products, although no official CVSS score is published in the advisory. The vendor recommends applying all previous errata before updating to the fixed version.

The vulnerability can cause denial of service due to resource exhaustion (memory and CPU) when processing malicious OIDC tokens. This can lead to service unavailability in affected Red Hat products that use Fulcio, including the OpenShift Security Profiles Operator. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported. The issue affects availability and could disrupt normal operations of the affected components.

Red Hat has released Security Profiles Operator version 0.10.0 which includes fixes for this vulnerability and other bugs. Users should ensure all previously released errata relevant to their systems are applied before updating. The update process is documented by Red Hat. No additional mitigations are specified beyond applying the official update. There is no indication that the vulnerability is already mitigated or that no action is required.