CVE-2025-66506 describes a denial of service vulnerability in Fulcio, a certificate authority used by Red Hat OpenShift Pipelines Operator 1.21.1. The vulnerability arises from processing a crafted OpenID Connect (OIDC) token containing numerous period characters, which triggers excessive memory allocation leading to resource exhaustion. This flaw is categorized under CWE-405 (Asymmetric Resource Consumption) and related CWEs. The vulnerability affects Red Hat OpenShift Pipelines Operator 1.21.1 and potentially other products using Fulcio. Red Hat has not yet released a fix for this vulnerability as of the advisory date. The CVSS score assigned by Red Hat is 7.5 (high severity), reflecting network attack vector, low complexity, no privileges required, and high availability impact.

The vulnerability can cause denial of service by exhausting system memory resources when processing malicious OIDC tokens, leading to service unavailability in affected Red Hat products that utilize Fulcio. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

No official fix or patch is currently available for this vulnerability in Red Hat OpenShift Pipelines Operator 1.21.1. Users should monitor Red Hat advisories for updates. Since this is a denial of service vulnerability triggered by malicious OIDC tokens, consider restricting or validating OIDC token inputs where possible as a temporary mitigation. Red Hat Product Security can be contacted for further guidance. Avoid relying solely on version numbers for vulnerability status due to backporting practices.