Cyber Resilience

CVE-2025-66564

DoS in Linuxfoundation Sigstore Timestamp Authority ≤ 2.0.3

Published
04 December 2025
Modified
17 March 2026
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0042 35th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-66564 is a high-severity Amplification (CWE-405) vulnerability in Linuxfoundation Sigstore Timestamp Authority. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which…

more

is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

CWE-405 resource exhaustion via malicious untrusted input to public API directly enables application-layer DoS through exploitation of the parsing flaw.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-66506Same vendor: Linuxfoundation
CVE-2026-44247Same vendor: Linuxfoundation
CVE-2025-68135Same vendor: Linuxfoundation
CVE-2026-54712Same vendor: Linuxfoundation
CVE-2026-58207Same vendor: Linuxfoundation
CVE-2026-27828Same vendor: Linuxfoundation
CVE-2026-33022Same vendor: Linuxfoundation
CVE-2024-24422Same vendor: Linuxfoundation
CVE-2024-24418Same vendor: Linuxfoundation
CVE-2025-68133Same vendor: Linuxfoundation

Affected Assets

linuxfoundation
sigstore timestamp authority
≤ 2.0.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of untrusted inputs (OID strings and Content-Type headers) before parsing/splitting to block the O(n) allocation amplification.

prevent

Provides denial-of-service protection controls that can limit resource exhaustion from malicious requests exploiting the split operations.

detect

Enables monitoring and analysis of API request patterns to identify anomalous inputs that trigger excessive allocations in ParseJSONRequest or getContentType.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-03 mostly match
prevents

Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.

PR.IR-04 mostly match
prevents

Capacity planning and monitoring maintain availability headroom against amplification attacks.

DE.CM-01 partial match
prevents

Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.

DE.CM-09 partial match
prevents

Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

none

Stress-testing and demand-reduction tactics (e.g., bandwidth throttling) blunt amplification vectors that would otherwise let an attacker multiply resource consumption through a single request.

References