Cyber Resilience

CVE-2025-66506

DoS in Linuxfoundation Fulcio ≤ 1.8.3

Published
04 December 2025
Modified
10 March 2026
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0019 9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-66506 is a high-severity Amplification (CWE-405) vulnerability in Linuxfoundation Fulcio. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in…

more

the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

CWE-405 resource exhaustion via malicious untrusted input directly enables application-layer DoS via exploitation (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-66564Same vendor: Linuxfoundation
CVE-2026-22772Same product: Linuxfoundation Fulcio
CVE-2026-44247Same vendor: Linuxfoundation
CVE-2025-68135Same vendor: Linuxfoundation
CVE-2026-54712Same vendor: Linuxfoundation
CVE-2026-58207Same vendor: Linuxfoundation
CVE-2026-27828Same vendor: Linuxfoundation
CVE-2026-33022Same vendor: Linuxfoundation
CVE-2024-24422Same vendor: Linuxfoundation
CVE-2024-24418Same vendor: Linuxfoundation

Affected Assets

linuxfoundation
fulcio
≤ 1.8.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Rejects or bounds untrusted OIDC token input before strings.Split produces O(n) allocations.

prevent

Directly mitigates asymmetric resource consumption attacks that exhaust memory from malformed tokens.

prevent

Enforces memory protections that limit the impact of uncontrolled heap growth from the vulnerable parsing path.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-03 mostly match
prevents

Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.

PR.IR-04 mostly match
prevents

Capacity planning and monitoring maintain availability headroom against amplification attacks.

DE.CM-01 partial match
prevents

Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.

DE.CM-09 partial match
prevents

Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

none

Stress-testing and demand-reduction tactics (e.g., bandwidth throttling) blunt amplification vectors that would otherwise let an attacker multiply resource consumption through a single request.

References