CVE-2025-66564High· 7.5▾ TwilightSigstore Timestamp Authority allocates excessive memory during request parsing
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
Excessive memory allocation
Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string.
As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)
Upgrade to v2.0.3.
There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.
github.com/sigstore/timestamp-authority < 2.0.3Upgrade to a patched release:
github.com/sigstore/timestamp-authority 2.0.3Connected by shared product, vendor, weakness, or advisory.
CVE-2024-29902Medium· 4.2Cosign malicious attachments can cause system-wide denial of service
CVE-2026-44309Medium· 5.3gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
CVE-2026-44310Medium· 5.4gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
CVE-2022-35930High· 7.1PolicyController before 0.2.1 may bypass attestation verification
CVE-2026-22772Medium· 5.8Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
CVE-2023-30551High· 7.5Rekor's compressed archives can result in OOM conditions