Sigstore Timestamp Authority allocates excessive memory during request parsing
Summary
Sigstore Timestamp Authority allocates excessive memory during request parsing
Original description
The description as published by the source.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-66564 golang-github-sigstore-timestamp-authority
- Ubuntu UBUNTU-CVE-2025-66564 golang-github-sigstore-timestamp-authority
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com