Read the docs
TI-2025-40928 Aliases CVE-2025-66506GHSA-f83f-xpx7-ffpw

Fulcio allocates excessive memory during token parsing

Priority LOW 38CWE-405Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 21 fixed, 19 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Fix Partial fulcio (sigstore): 1.8.3github.com/sigstore/fulcio (Go): 1.8.3Red Hat: 36 advisoriesRed Hat: 21 fixed, 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sigstorefulciobefore 1.8.31.8.3Patch availableCNA
—github.com/sigstore/fulcio (Go)before 1.8.31.8.3Patch availableGHSA-f83f-xpx7-ffpw
  • fulcio Vendorsigstore Affected before 1.8.3 Fixed in 1.8.3 Patch available CNA
  • github.com/sigstore/fulcio (Go) Vendor— Affected before 1.8.3 Fixed in 1.8.3 Patch available GHSA-f83f-xpx7-ffpw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:fulcio:*:*:*:*:*:*:*:*before 1.8.3Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:fulcio:*:*:*:*:*:*:*:* Versions before 1.8.3 Vulnerable ·backstage

Remediation

  • Fix · CNA fulcio (sigstore) Fixed in 1.8.3
  • Fix · GHSA-f83f-xpx7-ffpw github.com/sigstore/fulcio (Go) Fixed in 1.8.3 Advisory →

Red Hat 36 advisories

  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
Show 33 more Red Hat advisories
  • RHSA-2026:6170 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.1
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
  • RHSA-2026:6166 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.1
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9, registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4185 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.13.11
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:3827 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.3
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9, registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel9
  • RHSA-2026:3825 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.3
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9
  • RHSA-2026:3723 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8, registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3712 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
  • RHSA-2026:3710 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.3
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:2924 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2922 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9 +1
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2852 Released 2026-02-17 · Red Hat rating Important
    OpenShift Security Profiles Operator bug fix and enhancement update
    • OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2754 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.9.18
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2695 Released 2026-02-12 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
  • RHSA-2026:2568 Released 2026-02-11 · Red Hat rating Important
    RHACS 4.9.3 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
  • RHSA-2026:2350 Released 2026-02-09 · Red Hat rating Important
    RHACS 4.9.3 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
  • RHSA-2026:2144 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7
  • RHSA-2026:2136 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9 +1
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1517 Released 2026-01-28 · Red Hat rating Important
    RHACS 4.8.8 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:1049 Released 2026-01-22 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.0
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
  • RHSA-2025:23449 Released 2025-12-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23209 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (TPU)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-tpu-rhel9
  • RHSA-2025:23205 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23204 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23202 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Multiarch Tuning OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift API for Data ProtectionAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix planned: Will not fix
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift Security Profiles Operator 1Fixed RHSA-2026:2852
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23202, RHSA-2025:23204, RHSA-2025:23205, RHSA-2025:23209, RHSA-2025:23449, RHSA-2026:3461, RHSA-2026:3462
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:1517
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:2350, RHSA-2026:2568
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:2106, RHSA-2026:2695
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Red Hat OpenShift Pipelines 1.15Fixed RHSA-2026:3710, RHSA-2026:3723
Red Hat OpenShift Pipelines 1.20Fixed RHSA-2026:3825, RHSA-2026:3827
Red Hat OpenShift Pipelines 1.21Fixed RHSA-2026:1049, RHSA-2026:6166, RHSA-2026:6170
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2026:4185
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.9Fixed RHSA-2026:2754
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2922, RHSA-2026:2924
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:2136, RHSA-2026:2144
Not affected: 45 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Compliance Operator
  • Confidential Compute Attestation
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • File Integrity Operator
  • Kernel Module Management Operator for Red Hat Openshift
  • Logical Volume Manager Storage
  • Migration Toolkit for Containers
  • Multicluster Engine for Kubernetes
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift API for Data Protection 1.3
  • OpenShift Security Profiles Operator 1
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Power monitoring for Red Hat OpenShift
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Kueue
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Pipelines 1.15
  • Red Hat OpenShift Pipelines 1.20
  • Red Hat OpenShift Pipelines 1.21
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer 1.2
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Web Terminal

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66506
  2. 2026-10-03 Alias added: GHSA-f83f-xpx7-ffpw
  3. 2026-10-07 Fix available: OpenShift Security Profiles Operator 1, Red Hat OpenShift Pipelines 1.20 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat
  6. 2026-11-06 Fix available: RHSA-2026:6166 · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2022-16356 False positive signature verification in cosign CVSS 3.1CRITICAL 9.8
  • TI-2026-36084 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced CVSS 3.1HIGH 7.5
  • TI-2024-19670 Cosign vulnerable to machine-wide denial of service via malicious artifacts CVSS 3.1HIGH 7.5
  • TI-2026-18290 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVSS 3.1MEDIUM 5.8
  • TI-2026-36085 sigstore-js: Insufficient Verification of Data Authenticity CVSS 3.1MEDIUM 6.5
  • TI-2024-19669 Cosign vulnerable to system-wide denial of service via malicious attachments CVSS 3.1MEDIUM 5.9
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences