GO-2025-4193: github.com/sigstore/fulcio fixed in 1.8.3

GO-2025-4193 PUBLISHED

Record from OSV · Published December 8, 2025

github.com/sigstore/fulcio is fixed in 1.8.3 (Go Modules)

Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

56 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
wolfi	witness	0
wolfi	zarf	0
wolfi	slsa-verifier	0
chainguard	gitsign	0
wolfi	sigstore-scaffolding	0
chainguard	kyverno-1.16	0
chainguard	tekton-chains	0
chainguard	cg	0
chainguard	cosign	0
chainguard	image-factory	0
github.com	sigstore/fulcio	0
chainguard	buildah	0
chainguard	aactl	0
wolfi	cosign	0
chainguard	flux-source-controller	0
chainguard	falcoctl-fips	0
chainguard	kyverno-policy-reporter-plugins-kyverno	0
chainguard	tekton-chains-fips	0
chainguard	kyverno-fips-1.15	0
wolfi	flux-source-controller	0

…and 48 more

The same record, from the CLI:

vulnetix vdb vuln GO-2025-4193
vulnetix vdb fixes GO-2025-4193

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2025-4193/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart