Description
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sigstore | fulcio | < 1.8.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-sigstore-fulcio | 1.8.5-1 | — |
| Debian 13 | golang-github-sigstore-fulcio | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-sigstore-fulcio | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-sigstore-fulcio | No fix yet | — |
| Ubuntu 25.10 | golang-github-sigstore-fulcio | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | govulncheck-vulndb | 0.0.20251209T172047-150000.1.127.1 | SUSE-SU-2025:4395-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251209T172047-150000.1.127.1 | SUSE-SU-2025:4395-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runfinch-finch | 1.10.0-1.amzn2023.0.6 | ALAS2023-2025-1336 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r41 | — |
| Wolfi rolling | buildah | 1.42.2-r1 | — |
| Wolfi rolling | cosign | 3.0.3-r0 | — |
| Wolfi rolling | falco-no-driver | 0.43.0-r1 | — |
| Wolfi rolling | falcoctl | 0.12.0-r0 | — |
| Wolfi rolling | flux-source-controller | 1.7.4-r4 | — |
| Wolfi rolling | gitsign +1 | 0.14.0-r0 | — |
| Wolfi rolling | kots +2 | 1.129.1-r1 | — |
| Wolfi rolling | kubescape | 3.0.47-r0 | — |
| Wolfi rolling | kyverno-notation-aws | 1.1-r28 | — |
| Wolfi rolling | podman +1 | 5.7.0-r4 | — |
| Wolfi rolling | portieris +1 | 0.13.33-r3 | — |
| Wolfi rolling | ratify | 1.4.0-r9 | — |
| Wolfi rolling | sigstore-scaffolding +13 | 0.7.31-r3 | — |
| Wolfi rolling | skopeo | 1.21.0-r1 | — |
| Wolfi rolling | slsa-verifier | 2.7.1-r6 | — |
| Wolfi rolling | tekton-chains | 0.26.0-r3 | — |
| Wolfi rolling | tkn | 0.43.0-r2 | — |
| Wolfi rolling | undock | 0.11.0-r2 | — |
| Wolfi rolling | vexctl | 0.4.1-r4 | — |
| Wolfi rolling | witness | 0.10.1-r3 | — |
| Wolfi rolling | zarf | 0.68.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sigstore/fulcio | < 1.8.3 | 1.8.3 | GHSA-f83f-xpx7-ffpw |
Advisories 4
- WID-SEC-2026-0199 Red Hat OpenShift Pipelines Operator (Fulcio): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 5, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2025:4395-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
- ALAS2023-2025-1336 Moderate: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026