CVE-2025-66506

Name of the Vulnerable Software and Affected Versions Fulcio versions prior to 1.8.3

Description Fulcio is a certificate authority for issuing code signing certificates for OpenID Connect (OIDC) identity. The identity.extractIssuerURL function splits its input, which is untrusted data, on periods. A malicious request with a large number of period characters in the OIDC identity token payload can cause the function to allocate memory proportional to the input length, potentially leading to excessive memory consumption.

Recommendations Update to version 1.8.3 or later.