CVE-2025-66564: Sigstore Timestamp Authority DoS Vulnerability

CVE-2025-66564 Overview

CVE-2025-66564 is a resource exhaustion vulnerability in the Sigstore Timestamp Authority, a service for issuing RFC 3161 timestamps. Prior to version 2.0.3, the api.ParseJSONRequest and api.getContentType functions improperly handle untrusted input data, leading to excessive memory allocations that can result in denial of service conditions.

The vulnerability stems from how the application processes string splitting operations on user-controlled data. When parsing an optionally-provided OID via strings.Split on period characters, or when processing the Content-Type header by splitting on an application string, malicious requests can trigger O(n) memory allocations where n represents the length of the malicious input.

Critical Impact

Attackers can exploit this vulnerability remotely without authentication to cause denial of service through memory exhaustion by sending crafted requests with excessively long OID values or malformed Content-Type headers.

Affected Products

• Linuxfoundation Sigstore Timestamp Authority versions prior to 2.0.3

Discovery Timeline

• 2025-12-04 - CVE-2025-66564 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2025-66564

Vulnerability Analysis

This vulnerability is classified under CWE-405 (Asymmetric Resource Consumption), which describes scenarios where an attacker can cause disproportionate resource consumption relative to the effort required to trigger it.

The core issue lies in the unsafe handling of string splitting operations within two critical API functions. The api.ParseJSONRequest function processes an optionally-provided OID field from request payloads. This OID data, which is untrusted user input, is split using Go's strings.Split function with period characters as delimiters. Similarly, the api.getContentType function splits the Content-Type header on an application string.

When an attacker crafts a request containing an excessively long OID with many period characters (e.g., thousands of periods), each split operation creates new string allocations in memory. The memory consumption grows linearly with the input size, making this an effective denial of service vector. The same principle applies to malformed Content-Type headers.

Root Cause

The root cause is improper input validation before performing string splitting operations on untrusted data. The functions do not implement any bounds checking or input length restrictions before calling strings.Split, allowing attackers to trigger unbounded memory allocations proportional to the input size.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can send specially crafted HTTP requests to the Timestamp Authority service containing:

1. An extremely long OID field in the JSON payload with numerous period characters
2. A malformed Content-Type header designed to maximize string allocations

The attack requires minimal attacker resources but can consume significant server memory, potentially causing service degradation or complete denial of service. Since the Sigstore Timestamp Authority is a critical component in software supply chain security infrastructure, exploitation could disrupt code signing and verification workflows.

Detection Methods for CVE-2025-66564

Indicators of Compromise

• Unusual spikes in memory consumption on servers running Sigstore Timestamp Authority
• HTTP requests with abnormally long OID values in JSON payloads
• Malformed or excessively long Content-Type headers in incoming requests
• Service crashes or restarts due to out-of-memory conditions

Detection Strategies

• Monitor HTTP request sizes and reject payloads exceeding reasonable thresholds at the network edge
• Implement application-level logging to track unusually long OID values or Content-Type headers
• Configure memory usage alerts for Timestamp Authority service processes
• Review web server access logs for patterns of requests with oversized headers or payloads

Monitoring Recommendations

• Set up memory utilization monitoring with alerting thresholds for the Timestamp Authority service
• Implement request rate limiting to mitigate volumetric attacks
• Monitor for repeated connection attempts from single sources with malformed requests

How to Mitigate CVE-2025-66564

Immediate Actions Required

• Upgrade Sigstore Timestamp Authority to version 2.0.3 or later immediately
• Review network logs for any signs of exploitation attempts
• Implement request size limits at the load balancer or reverse proxy level
• Consider temporarily rate limiting requests to the Timestamp Authority service

Patch Information

The vulnerability is fixed in Sigstore Timestamp Authority version 2.0.3. The fix is available in commit 0cae34e197d685a14904e0bad135b89d13b69421. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-4qg8-fj49-pxjh.

Workarounds

• Deploy a reverse proxy or WAF in front of the Timestamp Authority service to filter requests with oversized payloads or headers
• Implement input validation at the network edge to reject OID fields exceeding reasonable length limits
• Configure memory limits for the container or process running the Timestamp Authority to prevent system-wide impact
• Consider network segmentation to limit exposure of the Timestamp Authority service to trusted clients only