CVE-2025-66564: linuxfoundation sigstore_timestamp_authority

Vulnerability summary

CVE-2025-66564 is a high (CVSS 7.5) vulnerability in linuxfoundation sigstore_timestamp_authority. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37% of scored vulnerabilities.

Timeline

1. 04-12-2025
   PublishedVulnerability first disclosed.
2. 05-12-2025
   Last modifiedVulnerability information updated.

Description

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.

• CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."