VDB
GO-2025-4193
GO-2025-4193
PUBLISHED
Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | witness | 0 |
| wolfi | zarf | 0 |
| wolfi | slsa-verifier | 0 |
| chainguard | gitsign | 0 |
| wolfi | sigstore-scaffolding | 0 |
| chainguard | kyverno-1.16 | 0 |
| chainguard | tekton-chains | 0 |
| chainguard | cg | 0 |
| chainguard | cosign | 0 |
| chainguard | image-factory | 0 |
| github.com | sigstore/fulcio | 0 |
| chainguard | buildah | 0 |
| chainguard | aactl | 0 |
| wolfi | cosign | 0 |
| chainguard | flux-source-controller | 0 |
| chainguard | falcoctl-fips | 0 |
| chainguard | kyverno-policy-reporter-plugins-kyverno | 0 |
| chainguard | tekton-chains-fips | 0 |
| chainguard | kyverno-fips-1.15 | 0 |
| wolfi | flux-source-controller | 0 |
…and 48 more
Timeline
- Dec 8, 2025 CVE Published
- Feb 4, 2026 CVE Updated
- May 1, 2026 Security Advisory