What is the CVSS score of CVE-2025-66564?

CVE-2025-66564 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sigstore Timestamp Authority are affected by CVE-2025-66564?

Sigstore Timestamp Authority (versions before 2.0.3) is vulnerable to a denial-of-service attack where attackers can trigger excessive memory consumption by sending malformed requests with specially…. A patch is available.

How to fix or mitigate CVE-2025-66564?

Within 24 hours: Verify which systems are running Sigstore Timestamp Authority and their versions; contact Sigstore project for patch availability timeline and any interim guidance. Within 7 days: Implement input validation and rate limiting on OID and Content-Type header handling at the network perimeter; monitor timestamp authority logs for suspicious requests with abnormally long OID values or malformed headers. Within 30 days: Deploy patched version 2.0.3 or later across all production instances; conduct post-patch security testing to confirm DoS vector is closed.

Sigstore Timestamp Authority CVE-2025-66564

EUVD-2025-201319 HIGH

Asymmetric Resource Consumption (Amplification) (CWE-405)

2025-12-04 security-advisories@github.com

GHSA-4qg8-fj49-pxjh

Information Disclosure Sigstore Timestamp Authority Red Hat Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201319

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 23:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.