An unauthenticated remote denial of service vulnerability in Sigstore Fulcio, fixed in version 1.8.3, allows attackers to trigger excessive memory allocation via malicious OIDC identity tokens.

This vulnerability is a CWE-405 asymmetric resource consumption flaw where the identity.extractIssuerURL function improperly handles arguments containing numerous period characters. An unauthenticated attacker can exploit this by sending a crafted OIDC identity token, forcing the application to perform excessive memory allocations.

The primary risk posed by this vulnerability is the potential for service disruption or system instability. Because the flaw allows for unauthenticated remote exploitation, an attacker could intentionally exhaust server resources, leading to a denial of service for legitimate code signing operations. With a CVSS score of 7.5, this is considered a high-severity issue that could impede development workflows and security infrastructure.

Immediate Action: Upgrade Sigstore Fulcio to version 1.8.3 or later to apply the necessary input validation fixes.

Proactive Monitoring: Monitor server memory usage and CPU load for sudden, anomalous spikes that correlate with incoming OIDC token validation requests.

Compensating Controls: Implement rate limiting or request size restrictions at the network edge or via a Web Application Firewall to drop suspicious tokens containing an excessive number of period characters.

Public Exploit Available: No confirmed public exploit (exploit_available: unknown).

Organizations utilizing Sigstore Fulcio for code signing must prioritize patching to version 1.8.3. This vulnerability represents a clear path for service interruption, and given the ease of triggering the O(n) memory allocation, administrators should treat this update as a standard maintenance priority to ensure the continued availability of identity verification services.