CVE-2025-66506

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

• CWE-405

• https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5aPatch
• https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpwVendor Advisory

Published

Dec 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66499A heap-based buffer overflow vulnerability exists in the PDF…7.8
• CVE-2025-6650PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66500A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-66501A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-66502A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-66503An out-of-bounds read vulnerability exists in the EMF functi…7.1
• CVE-2025-665071Panel is an open-source, web-based control panel for Linux …7.5
• CVE-2025-665081Panel is an open-source, web-based control panel for Linux …6.5
• CVE-2025-66509LaraDashboard is an all-In-one solution to start a Laravel A…9.8
• CVE-2025-6651PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remo…7.8
• CVE-2025-66510Nextcloud Server is a self hosted personal cloud system. In …4.9
• CVE-2025-66511Nextcloud Calendar is a calendar app for Nextcloud. Prior to…6.5