VDB
RHSA-2026%3A3723
RHSA-2026%3A3723
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:19a36e841519488d5895b999f84bffd8200c16b026f769ac72919296c65cc136_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | *, registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:19a36e841519488d5895b999f84bffd8200c16b026f769ac72919296c65cc136_arm64, registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:19a36e841519488d5895b999f84bffd8200c16b026f769ac72919296c65cc136_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:29e53c58884174c78c5b86c8f63024f4643c9b5f90e476eddd5fd4725855a0d4_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:29e53c58884174c78c5b86c8f63024f4643c9b5f90e476eddd5fd4725855a0d4_amd64, registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:29e53c58884174c78c5b86c8f63024f4643c9b5f90e476eddd5fd4725855a0d4_amd64, registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:29e53c58884174c78c5b86c8f63024f4643c9b5f90e476eddd5fd4725855a0d4_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:83f7ba7cdf1b25ac5b9c91cd3aa76c1d7136a3d34d826f19a4fe4813a9c062d1_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:bbf204c5370405e55ef38b687bcb207806043c5e87b6735cad76e0dd202213db_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9d33602222295d4ecab52e990e0af7ae5f84e094721c2afaea1ddca904a91ae2_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9d33602222295d4ecab52e990e0af7ae5f84e094721c2afaea1ddca904a91ae2_arm64, *, * |
| Red Hat | Red Hat OpenShift Pipelines | |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:29e53c58884174c78c5b86c8f63024f4643c9b5f90e476eddd5fd4725855a0d4_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:29e53c58884174c78c5b86c8f63024f4643c9b5f90e476eddd5fd4725855a0d4_amd64, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9d33602222295d4ecab52e990e0af7ae5f84e094721c2afaea1ddca904a91ae2_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9d33602222295d4ecab52e990e0af7ae5f84e094721c2afaea1ddca904a91ae2_arm64, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9d33602222295d4ecab52e990e0af7ae5f84e094721c2afaea1ddca904a91ae2_arm64, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9d33602222295d4ecab52e990e0af7ae5f84e094721c2afaea1ddca904a91ae2_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:19a36e841519488d5895b999f84bffd8200c16b026f769ac72919296c65cc136_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:2aa9f0a7afddf5e2ad7c642eb72a874c4d7e5a092828753da19e657fb6db69cb_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:2aa9f0a7afddf5e2ad7c642eb72a874c4d7e5a092828753da19e657fb6db69cb_s390x, registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:2aa9f0a7afddf5e2ad7c642eb72a874c4d7e5a092828753da19e657fb6db69cb_s390x, registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:2aa9f0a7afddf5e2ad7c642eb72a874c4d7e5a092828753da19e657fb6db69cb_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:74dd0d15fdcf95ac1eedea4dafc45598dda258fec28831acc95f2d2784804a04_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:74dd0d15fdcf95ac1eedea4dafc45598dda258fec28831acc95f2d2784804a04_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:74dd0d15fdcf95ac1eedea4dafc45598dda258fec28831acc95f2d2784804a04_ppc64le, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:74dd0d15fdcf95ac1eedea4dafc45598dda258fec28831acc95f2d2784804a04_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:682728a8ecb86109fbcc407e7ac4114d7993ed9acc11bb49f7761197a4965ad9_s390x as a component of Red Hat OpenShift Pipelines 1.15 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:a914252e2e10112e151571221a7f6b9db43d4584b8b906a960df4d6f358dcfb9_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:a914252e2e10112e151571221a7f6b9db43d4584b8b906a960df4d6f358dcfb9_amd64, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:a914252e2e10112e151571221a7f6b9db43d4584b8b906a960df4d6f358dcfb9_amd64, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:a914252e2e10112e151571221a7f6b9db43d4584b8b906a960df4d6f358dcfb9_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x, *, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:c9fe952471a5033cb77237850bcbcbb7690e9b4bafaa9a10d5a3b40bc4a49791_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:f128ce3188364bdf50142e1211e976dbb0bac67f541bad87a5577e81ef30e41b_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:644385b4abc586388b938baec6207d4406e0ff906aded74871644120143170a5_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | *, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:644385b4abc586388b938baec6207d4406e0ff906aded74871644120143170a5_arm64, registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:644385b4abc586388b938baec6207d4406e0ff906aded74871644120143170a5_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:682728a8ecb86109fbcc407e7ac4114d7993ed9acc11bb49f7761197a4965ad9_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:682728a8ecb86109fbcc407e7ac4114d7993ed9acc11bb49f7761197a4965ad9_s390x, registry.redhat.io/openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:682728a8ecb86109fbcc407e7ac4114d7993ed9acc11bb49f7761197a4965ad9_s390x, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:2aa9f0a7afddf5e2ad7c642eb72a874c4d7e5a092828753da19e657fb6db69cb_s390x as a component of Red Hat OpenShift Pipelines 1.15 | *, *, registry.redhat.io/openshift-pipelines/pipelines-rhel8-operator@sha256:2aa9f0a7afddf5e2ad7c642eb72a874c4d7e5a092828753da19e657fb6db69cb_s390x |
…and 9 more
Timeline
- Mar 4, 2026 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:3723 advisory
- https://access.redhat.com/security/cve/CVE-2025-66506 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3723.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2419056 issue
- https://www.cve.org/CVERecord?id=CVE-2025-66506 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66506 advisory
- https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a advisory
- https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw advisory