https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:51:27.301895+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 certfr-2026-avi-0249 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T20:51:27.757912+00:00 certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 Withdrawn: CLEANSTART-2026-BA61304 — Security fixes in cosign 2.4.3-r0 2026-10-03T20:51:27.757978+00:00

Withdrawn by the publisher.

Affected: CleanStart: cosign

Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...

 https://cve.radiocsirt.org/vuln/euvd-2026-262637 EUVD-2026-262637 2026-10-03T20:51:27.758011+00:00 EUVD-2026-262637 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66506 fkie_cve-2025-66506 2026-10-03T20:51:27.758025+00:00

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

 https://cve.radiocsirt.org/vuln/ghsa-f83f-xpx7-ffpw GHSA-f83f-xpx7-ffpw — Fulcio allocates excessive memory during token parsing 2026-10-03T20:51:27.758051+00:00

Affected: Go: github.com/sigstore/fulcio

Function [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to `extractIssuerURL` incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)

Details See [identity.extractIssuerURL](https://github.com/sigstore/fulcio/blob/main/pkg/identity/issuerpool.go#L44-L45)

Impact Excessive memory allocation

 https://cve.radiocsirt.org/vuln/rhsa-2025:23202 RHSA-2025:23202 — Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA) 2026-10-03T20:51:27.758079+00:00

openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh runc: container escape with malicious config due to /dev/console mount and related races firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66506 UBUNTU-CVE-2025-66506 2026-10-03T20:51:27.758109+00:00

Affected: Ubuntu:25.10: golang-github-sigstore-fulcio, Ubuntu:26.04:LTS: golang-github-sigstore-fulcio

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0199 WID-SEC-W-2026-0199 — Red Hat OpenShift Pipelines Operator (Fulcio): Schwachstelle ermöglicht Denial of Service 2026-10-03T20:51:27.758134+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Pipelines Operator ausnutzen, um einen Denial of Service Angriff durchzuführen.