CVE-2025-66506: linuxfoundation fulcio

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2025-66506DEBIAN-CVE-2025-66506CGA-2574-f57h-6qmj+251 more

Published 04-12-2025Last modified 05-12-2025

Vulnerability summary

CVE-2025-66506 is a high (CVSS 7.5) vulnerability in linuxfoundation fulcio. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 6

OPENSUSE-SU-2026:21483-1 SUSE-SU-2025:4395-1 CGA-63X2-WRQ7-39V8 CGA-995X-7M99-76HH CGA-QM2C-C9VF-HCR2 CGA-XVCQ-J77G-CQ82

Timeline

04-12-2025
PublishedVulnerability first disclosed.
05-12-2025
Last modifiedVulnerability information updated.

Description

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

0.00 pp

From 0.21% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Affected systems

Chainguard120 products

aactl< 0.4.12-r41
buildah< 1.42.2-r1
cg< 0.2.193-r1
chainctl< 0.2.194-r0
cosign< 3.0.3-r0

cosign-fips< 3.0.3-r0
falco-no-driver< 0.43.0-r1
falcoctl< 0.12.0-r0
falcoctl-fips< 0.12.1-r0
flux-source-controller< 1.7.4-r4
flux-source-controller-fips< 1.7.4-r4
gitsign< 0.14.0-r0
gitsign-credential-cache< 0.14.0-r0
image-factory< 0.9.0-r2
image-factory-fips< 0.9.0-r2
kots< 1.129.1-r1
kots-compat< 1.129.1-r1
kots-symlink-compat< 1.129.1-r1
kubescape< 3.0.47-r0
kyverno-1.13All versions (No fix recorded)
kyverno-1.14All versions (No fix recorded)
kyverno-1.15< 1.15.3-r23
kyverno-1.16< 1.16.2-r1
kyverno-background-controller-1.13All versions (No fix recorded)
kyverno-background-controller-1.14All versions (No fix recorded)
kyverno-background-controller-1.15< 1.15.3-r23
kyverno-background-controller-1.16< 1.16.2-r1
kyverno-background-controller-fips-1.13All versions (No fix recorded)
kyverno-background-controller-fips-1.14All versions (No fix recorded)
kyverno-background-controller-fips-1.15< 1.15.20-r8
kyverno-background-controller-fips-1.16< 1.16.2-r1
kyverno-cleanup-controller-1.13All versions (No fix recorded)
kyverno-cleanup-controller-1.14All versions (No fix recorded)
kyverno-cleanup-controller-1.15< 1.15.3-r23
kyverno-cleanup-controller-1.16< 1.16.2-r1
kyverno-cleanup-controller-fips-1.13All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.14All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.15< 1.15.20-r8
kyverno-cleanup-controller-fips-1.16< 1.16.2-r1
kyverno-cli-1.13All versions (No fix recorded)
kyverno-cli-1.14All versions (No fix recorded)
kyverno-cli-1.15< 1.15.3-r23
kyverno-cli-1.16< 1.16.2-r1
kyverno-cli-fips-1.13All versions (No fix recorded)
kyverno-cli-fips-1.14All versions (No fix recorded)
kyverno-cli-fips-1.15< 1.15.20-r8
kyverno-cli-fips-1.16< 1.16.2-r1
kyverno-fips-1.13All versions (No fix recorded)
kyverno-fips-1.14All versions (No fix recorded)
kyverno-fips-1.15< 1.15.20-r8
kyverno-fips-1.16< 1.16.2-r1
kyverno-init-container-1.13All versions (No fix recorded)
kyverno-init-container-1.14All versions (No fix recorded)
kyverno-init-container-1.15< 1.15.3-r23
kyverno-init-container-1.16< 1.16.2-r1
kyverno-init-container-fips-1.13All versions (No fix recorded)
kyverno-init-container-fips-1.14All versions (No fix recorded)
kyverno-init-container-fips-1.15< 1.15.20-r8
kyverno-init-container-fips-1.16< 1.16.2-r1
kyverno-notation-aws< 1.1-r28
kyverno-notation-aws-fips< 1.1-r28
kyverno-policy-reporter-plugins-kyverno< 0.5.3-r0
kyverno-policy-reporter-plugins-kyverno-fips< 0.5.3-r0
kyverno-reports-controller-1.13All versions (No fix recorded)
kyverno-reports-controller-1.14All versions (No fix recorded)
kyverno-reports-controller-1.15< 1.15.3-r23
kyverno-reports-controller-1.16< 1.16.2-r1
kyverno-reports-controller-fips-1.13All versions (No fix recorded)
kyverno-reports-controller-fips-1.14All versions (No fix recorded)
kyverno-reports-controller-fips-1.15< 1.15.20-r8
kyverno-reports-controller-fips-1.16< 1.16.2-r1
podman< 5.7.0-r4
podman-doc< 5.7.0-r4
portieris< 0.13.33-r3
portieris-compat< 0.13.33-r3
portieris-fips< 0.13.33-r3
prometheus-podman-exporter< 1.19.0-r6
prometheus-podman-exporter-fips< 1.19.0-r7
ratify< 1.4.0-r9
ratify-fips< 1.4.0-r9
reports-serverAll versions (No fix recorded)
sigstore-scaffolding< 0.7.31-r3
sigstore-scaffolding-cloudsqlproxy< 0.7.31-r3
sigstore-scaffolding-ctlog-createctconfig< 0.7.31-r3
sigstore-scaffolding-ctlog-managectroots< 0.7.31-r3
sigstore-scaffolding-ctlog-verifyfulcio< 0.7.31-r3
sigstore-scaffolding-fips< 0.7.31-r4
sigstore-scaffolding-fips-cloudsqlproxy< 0.7.31-r4
sigstore-scaffolding-fips-ctlog-createctconfig< 0.7.31-r4
sigstore-scaffolding-fips-ctlog-managectroots< 0.7.31-r4
sigstore-scaffolding-fips-ctlog-verifyfulcio< 0.7.31-r4
sigstore-scaffolding-fips-fulcio-createcerts< 0.7.31-r4
sigstore-scaffolding-fips-getoidctoken< 0.7.31-r4
sigstore-scaffolding-fips-rekor-createsecret< 0.7.31-r4
sigstore-scaffolding-fips-trillian-createdb< 0.7.31-r4
sigstore-scaffolding-fips-trillian-createtree< 0.7.31-r4
sigstore-scaffolding-fips-trillian-updatetree< 0.7.31-r4
sigstore-scaffolding-fips-tsa-createcertchain< 0.7.31-r4
sigstore-scaffolding-fips-tuf-createsecret< 0.7.31-r4
sigstore-scaffolding-fips-tuf-server< 0.7.31-r4
sigstore-scaffolding-fulcio-createcerts< 0.7.31-r3
sigstore-scaffolding-getoidctoken< 0.7.31-r3
sigstore-scaffolding-rekor-createsecret< 0.7.31-r3
sigstore-scaffolding-trillian-createdb< 0.7.31-r3
sigstore-scaffolding-trillian-createtree< 0.7.31-r3
sigstore-scaffolding-trillian-updatetree< 0.7.31-r3
sigstore-scaffolding-tsa-createcertchain< 0.7.31-r3
sigstore-scaffolding-tuf-createsecret< 0.7.31-r3
sigstore-scaffolding-tuf-server< 0.7.31-r3
skopeo< 1.21.0-r1
skopeo-fips< 1.21.0-r1
slsa-verifier< 2.7.1-r6
tekton-chains< 0.26.0-r3
tekton-chains-fips< 0.26.0-r3
tkn< 0.43.0-r2
tkn-fips< 0.43.0-r2
undock< 0.11.0-r2
vexctl< 0.4.1-r4
witness< 0.10.1-r3
zarf< 0.68.1-r0

Show all 120

Wolfi46 products

aactl< 0.4.12-r41
buildah< 1.42.2-r1
cosign< 3.0.3-r0
falco-no-driver< 0.43.0-r1
falcoctl< 0.12.0-r0

Show all 46

Debian1 product

golang-github-sigstore-fulcioAll versions (No fix recorded) | < 1.8.5-1

Github.com/sigstore1 product

fulcio< 1.8.3

Linuxfoundation1 product

fulcio< 1.8.3

Sigstore1 product

fulcio< 1.8.3

Ubuntu1 product

golang-github-sigstore-fulcioAll versions (No fix recorded)

7 vendors · 171 products

References

8 links

github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpwX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5aX Refsource MISCREPORTFIXWEBPatch
ubuntu.com/security/CVE-2025-66506REPORT
www.cve.org/CVERecord?id=CVE-2025-66506REPORT
security-tracker.debian.org/tracker/CVE-2025-66506Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66506.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-66506Advisory
github.com/sigstore/fulcioPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities