VDB
RHSA-2026%3A1049
RHSA-2026%3A1049
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:511e668c1ffc13395f57cd53983b4ba6d76a7e4004d8a845bb940d86d775ada6_arm64 as a component of Red Hat OpenShift Pipelines 1.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:25aeacd4b3dc9fdc04f3d88b128658c8574798d125efff9496f7a936d85ceb04_ppc64le as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:25aeacd4b3dc9fdc04f3d88b128658c8574798d125efff9496f7a936d85ceb04_ppc64le, *, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:25aeacd4b3dc9fdc04f3d88b128658c8574798d125efff9496f7a936d85ceb04_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:25aeacd4b3dc9fdc04f3d88b128658c8574798d125efff9496f7a936d85ceb04_ppc64le as a component of Red Hat OpenShift Pipelines 1.21 | *, *, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:25aeacd4b3dc9fdc04f3d88b128658c8574798d125efff9496f7a936d85ceb04_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:bf1e73f5e9c64d63fa6c283617834f59d11c642ad92bf6ac08ebb0d4b0d2e089_arm64 as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:bf1e73f5e9c64d63fa6c283617834f59d11c642ad92bf6ac08ebb0d4b0d2e089_arm64, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:15d40f853744265a1f4f64e29d1da73056d87033faa393f17e2da75d19265008_arm64 as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:15d40f853744265a1f4f64e29d1da73056d87033faa393f17e2da75d19265008_arm64, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:15d40f853744265a1f4f64e29d1da73056d87033faa393f17e2da75d19265008_arm64, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:15d40f853744265a1f4f64e29d1da73056d87033faa393f17e2da75d19265008_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:b574aec30943382079ea6c60df7aacce77fe3caacf366a08fe2c37769061a1bd_amd64 as a component of Red Hat OpenShift Pipelines 1.21 | *, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:b574aec30943382079ea6c60df7aacce77fe3caacf366a08fe2c37769061a1bd_amd64, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:b574aec30943382079ea6c60df7aacce77fe3caacf366a08fe2c37769061a1bd_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:055d60f1ce44fdab089475c7fcbadb2764fdb453c05bba7ec918af82e4a2c7c1_amd64 as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:055d60f1ce44fdab089475c7fcbadb2764fdb453c05bba7ec918af82e4a2c7c1_amd64, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:055d60f1ce44fdab089475c7fcbadb2764fdb453c05bba7ec918af82e4a2c7c1_amd64, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:055d60f1ce44fdab089475c7fcbadb2764fdb453c05bba7ec918af82e4a2c7c1_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x as a component of Red Hat OpenShift Pipelines 1.21 | *, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:258f160b7fcb75aea2ebf51b9163c58eaad1dc0fbd9285a411564a5f93e8a190_ppc64le as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:258f160b7fcb75aea2ebf51b9163c58eaad1dc0fbd9285a411564a5f93e8a190_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:258f160b7fcb75aea2ebf51b9163c58eaad1dc0fbd9285a411564a5f93e8a190_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:258f160b7fcb75aea2ebf51b9163c58eaad1dc0fbd9285a411564a5f93e8a190_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:87ee30c0e63990331d779ff146fc811bd385f352c7c1d5b57d6d06fac2867f7b_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:a5672822c8a59e50317d79a697d7e93c9fca27df13dcbd999c3c7a18475243a2_amd64 as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:a5672822c8a59e50317d79a697d7e93c9fca27df13dcbd999c3c7a18475243a2_amd64, registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:a5672822c8a59e50317d79a697d7e93c9fca27df13dcbd999c3c7a18475243a2_amd64, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:e3475b5cd64b0a9e597f31fe7b6a7847b2bf924ce4feb123ebbf8e3424938f67_s390x as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:e3475b5cd64b0a9e597f31fe7b6a7847b2bf924ce4feb123ebbf8e3424938f67_s390x, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:258f160b7fcb75aea2ebf51b9163c58eaad1dc0fbd9285a411564a5f93e8a190_ppc64le as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator@sha256:258f160b7fcb75aea2ebf51b9163c58eaad1dc0fbd9285a411564a5f93e8a190_ppc64le, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:81280d1b2568f74e265a8ab579581b44843e6841be4aa55562df84298cceda99_s390x as a component of Red Hat OpenShift Pipelines 1.21 | *, *, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:81280d1b2568f74e265a8ab579581b44843e6841be4aa55562df84298cceda99_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:190f972cbf4951f32ccc666075c0c64751a98b4ac95f7b5762b39605084f4938_ppc64le as a component of Red Hat OpenShift Pipelines 1.21 | *, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:190f972cbf4951f32ccc666075c0c64751a98b4ac95f7b5762b39605084f4938_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:190f972cbf4951f32ccc666075c0c64751a98b4ac95f7b5762b39605084f4938_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:81280d1b2568f74e265a8ab579581b44843e6841be4aa55562df84298cceda99_s390x as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:81280d1b2568f74e265a8ab579581b44843e6841be4aa55562df84298cceda99_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:81280d1b2568f74e265a8ab579581b44843e6841be4aa55562df84298cceda99_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:81280d1b2568f74e265a8ab579581b44843e6841be4aa55562df84298cceda99_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:15d40f853744265a1f4f64e29d1da73056d87033faa393f17e2da75d19265008_arm64 as a component of Red Hat OpenShift Pipelines 1.21 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:e3475b5cd64b0a9e597f31fe7b6a7847b2bf924ce4feb123ebbf8e3424938f67_s390x as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:e3475b5cd64b0a9e597f31fe7b6a7847b2bf924ce4feb123ebbf8e3424938f67_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:e3475b5cd64b0a9e597f31fe7b6a7847b2bf924ce4feb123ebbf8e3424938f67_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:e3475b5cd64b0a9e597f31fe7b6a7847b2bf924ce4feb123ebbf8e3424938f67_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:190f972cbf4951f32ccc666075c0c64751a98b4ac95f7b5762b39605084f4938_ppc64le as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:190f972cbf4951f32ccc666075c0c64751a98b4ac95f7b5762b39605084f4938_ppc64le, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:65dda4d1773b5cbb5b192aea81186aacb8e200d5c033527fcc9b236125382df3_amd64 as a component of Red Hat OpenShift Pipelines 1.21 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel9@sha256:65dda4d1773b5cbb5b192aea81186aacb8e200d5c033527fcc9b236125382df3_amd64, *, * |
…and 6 more
Timeline
- Jan 22, 2026 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 26, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:1049 advisory
- https://access.redhat.com/security/cve/CVE-2025-66506 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1049.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2419056 issue
- https://www.cve.org/CVERecord?id=CVE-2025-66506 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66506 advisory
- https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a advisory
- https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw advisory