Input Validation Flaw in Sigstore Timestamp Authority Affects Multiple Versions

CVE-2025-66564

What is CVE-2025-66564?

The Sigstore Timestamp Authority, a service for issuing RFC 3161 timestamps, has a vulnerability in its input validation process. Versions prior to 2.0.3 contain flaws in the API methods api.ParseJSONRequest and api.getContentType, which handle untrusted data. These methods improperly split the OID and Content-Type header inputs on periods, leading to potential memory allocation issues when processing malicious requests. Such requests could contain excessively long OIDs or malformed Content-Type headers, resulting in performance degradation. The issue has been addressed in version 2.0.3.

References