{"id":"GHSA-4qg8-fj49-pxjh","revision":"5ea0258fedfb4e51ad046e78611e2033","records":[{"revision":"5ea0258fedfb4e51ad046e78611e2033","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-4qg8-fj49-pxjh","aliases":["CVE-2025-66564","GO-2025-4192"],"title":"Sigstore Timestamp Authority allocates excessive memory during request parsing","description":"### Impact\n\n**Excessive memory allocation**\n\nFunction [api.ParseJSONRequest](https://github.com/sigstore/timestamp-authority/blob/26d7d426d3000abdbdf2df34de56bb92246c0365/pkg/api/timestamp.go#L63) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) an optionally-provided OID (which is untrusted data) on periods. Similarly, function [api.getContentType](https://github.com/sigstore/timestamp-authority/blob/26d7d426d3000abdbdf2df34de56bb92246c0365/pkg/api/timestamp.go#L114) splits the `Content-Type` header (which is also untrusted data) on an `application` string.\n\nAs a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed `Content-Type` header, a call to `api.ParseJSONRequest` or `api.getContentType` incurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)\n\n### Patches\n\nUpgrade to v2.0.3.\n\n### Workarounds\n\nThere are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.","state":0,"publishedAt":"2025-12-05T18:19:00+00:00","modifiedAt":"2026-09-10T03:50:31.4139972+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/timestamp-authority","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh","https://nvd.nist.gov/vuln/detail/CVE-2025-66564","https://github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421","https://github.com/sigstore/timestamp-authority"],"sourceUrl":"https://github.com/advisories/GHSA-4qg8-fj49-pxjh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4qg8-fj49-pxjh","identifiers":["GHSA-4qg8-fj49-pxjh","CVE-2025-66564","GO-2025-4192"]},"retained":false,"historicalAffected":[]}],"coverage":[]}