Vulnerability · Published Dec 4, 2025 · Assigned by GitHub_M
CVE-2025-66564Sigstore Timestamp Authority allocates excessive memory during request parsing
High 7.5
In plain English
A high-severity security flaw in timestamp-authority from sigstore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | golang-github-sigstore-timestamp-authority | no fix listed | DEBIAN-CVE-2025-66564 |
| Debian:14 | golang-github-sigstore-timestamp-authority | 2.0.3-1 | DEBIAN-CVE-2025-66564 |
| Go | github.com/sigstore/timestamp-authority | 2.0.3 | GHSA-4qg8-fj49-pxjh |
| Go | github.com/sigstore/timestamp-authority | no fix listed | GO-2025-4192 |
| Go | github.com/sigstore/timestamp-authority/v2 | 2.0.3 | GO-2025-4192 |
| Ubuntu:25.10 | golang-github-sigstore-timestamp-authority | no fix listed | UBUNTU-CVE-2025-66564 |
| Ubuntu:26.04:LTS | golang-github-sigstore-timestamp-authority | no fix listed | UBUNTU-CVE-2025-66564 |
| Ubuntu:26.10 | golang-github-sigstore-timestamp-authority | no fix listed | UBUNTU-CVE-2025-66564 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sigstore | timestamp-authority | < 2.0.3 |
Weakness: CWE-405 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H