MEDIUM5.8Go
GHSA-59jp-pj84-45mr· CVE-2026-22772, GO-2026-4311Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
Modified: 9/10/2026
package
Go/github.com/sigstore/fulcio
pkg:go/github.com/sigstore/fulcio
HIGH8.7Go
GHSA-f5mr-q85p-6hh6· CVE-2026-49478, GO-2026-5853Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
Modified: 9/10/2026
HIGH7.5Go
GHSA-f83f-xpx7-ffpw· CVE-2025-66506, GO-2025-4193Fulcio allocates excessive memory during token parsing
Modified: 9/10/2026
—Go
GO-2025-4193· CVE-2025-66506, GHSA-f83f-xpx7-ffpwFulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio
Modified: 2/4/2026
—Go
GO-2026-4311· CVE-2026-22772, GHSA-59jp-pj84-45mrFulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
Modified: 2/4/2026
—Go
GO-2026-5853· CVE-2026-49478, GHSA-f5mr-q85p-6hh6Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio
Modified: 7/10/2026