CVE-2025-66506
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Dec 4, 2025
CISA due date
—
The record
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sigstore/fulcio | 0 | 1.8.3 |
| Chainguard | aactl | 0 | 0.4.12-r41 |
| Chainguard | buildah | 0 | 1.42.2-r1 |
| Chainguard | cg | 0 | 0.2.193-r1 |
| Chainguard | chainctl | 0 | 0.2.194-r0 |
| Chainguard | cosign | 0 | 3.0.3-r0 |
| Chainguard | cosign-fips | 0 | 3.0.3-r0 |
| Chainguard | docker-credential-cgr | 0 | 0.2.183-r0 |
| Chainguard | falco-dev | 0 | 0.42.1-r0 |
| Chainguard | falco-no-driver | 0 | 0.43.0-r1 |
| Chainguard | falco-plugin-container | 0 | 0.42.1-r1 |
| Chainguard | falco-src | 0 | 0.42.1-r0 |
| Chainguard | falcoctl | 0 | 0.12.0-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.1-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r4 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r4 |
| Chainguard | flux-source-controller-iamguarded-compat | 0 | 1.7.4-r3 |
| Chainguard | gitsign | 0 | 0.14.0-r0 |
| Chainguard | gitsign-config | 0 | 0.13.0-r7 |
| Chainguard | gitsign-credential-cache | 0 | 0.14.0-r0 |
| Chainguard | image-factory | 0 | 0.9.0-r2 |
| Chainguard | image-factory-fips | 0 | 0.9.0-r2 |
| Chainguard | kots | 0 | 1.129.1-r1 |
| Chainguard | kots-compat | 0 | 1.129.1-r1 |
| Chainguard | kots-symlink-compat | 0 | 1.129.1-r1 |
| Chainguard | kubescape | 0 | 3.0.47-r0 |
| Chainguard | kyverno-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-cleanup-controller-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r27 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r28 |
| Chainguard | kyverno-notation-aws-compat | 0 | 1.1-r25 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r27 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r28 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno | 0 | 0.5.3-r0 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-compat | 0 | 0.5.2-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-fips | 0 | 0.5.3-r0 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.2-r1 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.2-r1 |
| Chainguard | podman | 0 | 5.7.0-r4 |
| Chainguard | podman-doc | 0 | 5.7.0-r4 |
| Chainguard | portieris | 0 | 0.13.33-r3 |
| Chainguard | portieris-compat | 0 | 0.13.33-r3 |
| Chainguard | portieris-fips | 0 | 0.13.33-r3 |
| Chainguard | prometheus-podman-exporter | 0 | 1.19.0-r6 |
| Chainguard | prometheus-podman-exporter-compat | 0 | 1.19.0-r6 |
| Chainguard | prometheus-podman-exporter-fips | 0 | 1.19.0-r7 |
| Chainguard | ratify | 0 | 1.4.0-r9 |
| Chainguard | ratify-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-crds | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips | 0 | 1.4.0-r9 |
| Chainguard | ratify-fips-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-crds | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-licensechecker | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-licensechecker-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-sbom | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-sbom-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-schemavalidator | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-schemavalidator-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-vulnerabilityreport | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-vulnerabilityreport-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-licensechecker | 0 | 1.4.0-r8 |
| Chainguard | ratify-licensechecker-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-sbom | 0 | 1.4.0-r8 |
| Chainguard | ratify-sbom-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-schemavalidator | 0 | 1.4.0-r8 |
| Chainguard | ratify-schemavalidator-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-vulnerabilityreport | 0 | 1.4.0-r8 |
| Chainguard | ratify-vulnerabilityreport-compat | 0 | 1.4.0-r8 |
| Chainguard | reports-server-compat | 0 | 0.1.5-r0 |
| Chainguard | sigstore-scaffolding | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-cloudsqlproxy | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-ctlog-createctconfig | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-ctlog-managectroots | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-ctlog-verifyfulcio | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-cloudsqlproxy | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-ctlog-createctconfig | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-ctlog-managectroots | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-ctlog-verifyfulcio | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-fulcio-createcerts | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-getoidctoken | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-rekor-createsecret | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-trillian-createdb | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-trillian-createtree | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-trillian-updatetree | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-tsa-createcertchain | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-tuf-createsecret | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fips-tuf-server | 0 | 0.7.31-r4 |
| Chainguard | sigstore-scaffolding-fulcio-createcerts | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-getoidctoken | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-rekor-createsecret | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-trillian-createdb | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-trillian-createtree | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-trillian-updatetree | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-tsa-createcertchain | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-tuf-createsecret | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r3 |
| Chainguard | skopeo | 0 | 1.21.0-r1 |
| Chainguard | skopeo-fips | 0 | 1.21.0-r1 |
| Chainguard | slsa-verifier | 0 | 2.7.1-r6 |
| Chainguard | tekton-chains | 0 | 0.26.0-r3 |
| Chainguard | tekton-chains-fips | 0 | 0.26.0-r3 |
| Chainguard | tkn | 0 | 0.43.0-r2 |
| Chainguard | tkn-fips | 0 | 0.43.0-r2 |
| Chainguard | undock | 0 | 0.11.0-r1 |
| Chainguard | undock | 0 | 0.11.0-r2 |
| Chainguard | vexctl | 0 | 0.4.1-r4 |
| Chainguard | witness | 0 | 0.10.1-r3 |
| Chainguard | zarf | 0 | 0.68.1-r0 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| Wolfi | aactl | 0 | 0.4.12-r41 |
| Wolfi | buildah | 0 | 1.42.2-r1 |
| Wolfi | cosign | 0 | 3.0.3-r0 |
| Wolfi | cosign-fips | 0 | 3.0.3-r0 |
| Wolfi | falco-dev | 0 | 0.42.1-r0 |
| Wolfi | falco-no-driver | 0 | 0.43.0-r1 |
| Wolfi | falco-plugin-container | 0 | 0.42.1-r1 |
| Wolfi | falco-src | 0 | 0.42.1-r0 |
| Wolfi | falcoctl | 0 | 0.12.0-r0 |
| Wolfi | flux-source-controller | 0 | 1.7.4-r4 |
| Wolfi | flux-source-controller-iamguarded-compat | 0 | 1.7.4-r3 |
| Wolfi | gitsign | 0 | 0.14.0-r0 |
| Wolfi | gitsign-config | 0 | 0.13.0-r7 |
| Wolfi | gitsign-credential-cache | 0 | 0.14.0-r0 |
| Wolfi | kots | 0 | 1.129.1-r1 |
| Wolfi | kots-compat | 0 | 1.129.1-r1 |
| Wolfi | kots-symlink-compat | 0 | 1.129.1-r1 |
| Wolfi | kubescape | 0 | 3.0.47-r0 |
| Wolfi | kyverno-1.16 | 0 | 1.16.2-r1 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.2-r1 |
| Wolfi | kyverno-cleanup-controller-1.16 | 0 | 1.16.2-r1 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.2-r1 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.2-r1 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r27 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r28 |
| Wolfi | kyverno-notation-aws-compat | 0 | 1.1-r25 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.2-r1 |
| Wolfi | podman | 0 | 5.7.0-r4 |
| Wolfi | podman-doc | 0 | 5.7.0-r4 |
| Wolfi | portieris | 0 | 0.13.33-r3 |
| Wolfi | portieris-compat | 0 | 0.13.33-r3 |
| Wolfi | prometheus-podman-exporter | 0 | 1.19.0-r6 |
| Wolfi | prometheus-podman-exporter-compat | 0 | 1.19.0-r6 |
| Wolfi | ratify | 0 | 1.4.0-r9 |
| Wolfi | ratify-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-crds | 0 | 1.4.0-r8 |
| Wolfi | ratify-licensechecker | 0 | 1.4.0-r8 |
| Wolfi | ratify-licensechecker-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-sbom | 0 | 1.4.0-r8 |
| Wolfi | ratify-sbom-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-schemavalidator | 0 | 1.4.0-r8 |
| Wolfi | ratify-schemavalidator-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-vulnerabilityreport | 0 | 1.4.0-r8 |
| Wolfi | ratify-vulnerabilityreport-compat | 0 | 1.4.0-r8 |
| Wolfi | sigstore-scaffolding | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-cloudsqlproxy | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-ctlog-createctconfig | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-ctlog-managectroots | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-ctlog-verifyfulcio | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-fulcio-createcerts | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-getoidctoken | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-rekor-createsecret | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-trillian-createdb | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-trillian-createtree | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-trillian-updatetree | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-tsa-createcertchain | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-tuf-createsecret | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r3 |
| Wolfi | skopeo | 0 | 1.21.0-r1 |
| Wolfi | slsa-verifier | 0 | 2.7.1-r6 |
| Wolfi | tekton-chains | 0 | 0.26.0-r3 |
| Wolfi | tkn | 0 | 0.43.0-r2 |
| Wolfi | undock | 0 | 0.11.0-r1 |
| Wolfi | undock | 0 | 0.11.0-r2 |
| Wolfi | vexctl | 0 | 0.4.1-r4 |
| Wolfi | witness | 0 | 0.10.1-r3 |
| Wolfi | zarf | 0 | 0.68.1-r0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
Related vulnerabilities
- CVE-2026-22772 Fulcio is a certificate authority for issuing code signing certificates for an OpenID… Also affects github.com/sigstore/fulcio
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects aactl
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects aactl