What is the CVSS score of CVE-2025-66506?

CVE-2025-66506 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2025-66506?

Fulcio, a certificate authority used for code signing in software supply chain operations, contains a denial-of-service vulnerability that allows attackers to exhaust system resources through…. A patch is available.

How to fix or mitigate CVE-2025-66506?

Within 24 hours: Identify all systems running Fulcio and document current versions in use. Within 7 days: Apply the Fulcio 1.8.3 patch to all affected instances and validate functionality in a test environment first. Within 30 days: Complete production deployment of patched versions across all environments and confirm no instances remain on vulnerable versions.

Ubuntu CVE-2025-66506

EUVD-2025-201293 HIGH

Asymmetric Resource Consumption (Amplification) (CWE-405)

2025-12-04 security-advisories@github.com

GHSA-f83f-xpx7-ffpw

Information Disclosure Ubuntu Debian Fulcio Red Hat Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201293

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

Patch released

Mar 15, 2026 - 16:35 nvd

Patch available

CVE Published

Dec 04, 2025 - 22:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.