High · published December 5, 2025
⚡ A nefarious OIDC token could crash your service if left unchecked! 🎭 The flaw in Fulcio before version 1.8.3 could lead to a resource drain from malicious requests! Think of this like a clogged drain in a restaurant kitchen. One bad order with too many ingredients (period characters in this case) can overwhelm the system, causing backups that can slow your entire operation to a halt! An attacker could send a specially crafted OIDC identity token packed with period characters, leading to excessive memory allocations. If exploited, this could severely degrade performance or even crash your application, leaving your users frustrated and your service disrupted!
Think of this like a clogged drain in a restaurant kitchen. One bad order with too many ingredients (period characters in this case) can overwhelm the system, causing backups that can slow your entire operation to a halt! The vulnerability lies in the identity.extractIssuerURL function, which splits untrusted input on periods, causing it to allocate memory proportional to the input size, leading to potential Denial of Service (DoS).
An attacker could send a specially crafted OIDC identity token packed with period characters, leading to excessive memory allocations. If exploited, this could severely degrade performance or even crash your application, leaving your users frustrated and your service disrupted! Upgrade Fulcio to version 1.8.3 immediately to eliminate this vulnerability. Additionally, consider validating and sanitizing all input, especially for any untrusted data, to prevent similar issues in the future. You can tackle this! By following these steps, you'll strengthen your defenses. 🛡️ Let's keep that kitchen running smoothly!
| Product | Versions | Fixed in |
|---|---|---|
| linuxfoundation/fulcio | < 1.8.3 | 1.8.3 |