CVE-2025-66564: Sigstore Timestamp Authority allocates excessive memory during request parsing
Impact
Excessive memory allocation
Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string.
As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)
Patches
Upgrade to v2.0.3.
Workarounds
There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.
Other sources
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66564?
CVE-2025-66564 has a moderate severity rating due to the potential for parsing untrusted OIDs.
How do I fix CVE-2025-66564?
To fix CVE-2025-66564, upgrade Sigstore Timestamp Authority to version 2.0.3 or later.
What are the consequences of CVE-2025-66564?
CVE-2025-66564 may allow an attacker to exploit the untrusted data handling leading to denial of service.
Which versions of Sigstore Timestamp Authority are affected by CVE-2025-66564?
Versions of Sigstore Timestamp Authority prior to 2.0.3 are affected by CVE-2025-66564.
Is there a workaround for CVE-2025-66564?
There are no official workarounds for CVE-2025-66564, and upgrading is recommended.