DEBIAN-CVE-2026-22772

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-22772

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22772.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-22772

Upstream

CVE-2026-22772

Published

2026-01-12T21:15:59.457Z

Modified

2026-01-13T22:15:00.254509Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

References

https://security-tracker.debian.org/tracker/CVE-2026-22772

Affected packages

Debian:13 / golang-github-sigstore-fulcio

Package

Name: golang-github-sigstore-fulcio
Purl: pkg:deb/debian/golang-github-sigstore-fulcio?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.5-1

1.7.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-22772.json"

Debian:14 / golang-github-sigstore-fulcio