CVE-2025-66564
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Dec 4, 2025
CISA due date
—
The record
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sigstore/timestamp-authority | 0 | No fix |
| Go | github.com/sigstore/timestamp-authority | 0 | 2.0.3 |
| Go | github.com/sigstore/timestamp-authority/v2 | 0 | 2.0.3 |
| Chainguard | aactl | 0 | 0.4.12-r43 |
| Chainguard | cg | 0 | 0.2.193-r1 |
| Chainguard | chainctl | 0 | 0.2.194-r0 |
| Chainguard | cloudbeat-9.3 | 0 | 9.3.1-r0 |
| Chainguard | cloudbeat-fips-9.3 | 0 | 9.3.0-r1 |
| Chainguard | cosign | 0 | 3.0.3-r0 |
| Chainguard | cosign-fips | 0 | 3.0.3-r0 |
| Chainguard | crossplane-1.20 | 0 | 1.20.4-r2 |
| Chainguard | crossplane-1.20-crank | 0 | 1.20.4-r1 |
| Chainguard | crossplane-2.0 | 0 | 2.0.6-r2 |
| Chainguard | crossplane-2.0-crank | 0 | 2.0.6-r1 |
| Chainguard | crossplane-2.1 | 0 | 2.1.3-r2 |
| Chainguard | crossplane-2.1-crank | 0 | 2.1.3-r1 |
| Chainguard | crossplane-fips-1.20 | 0 | 1.20.4-r2 |
| Chainguard | crossplane-fips-1.20-crank | 0 | 1.20.4-r1 |
| Chainguard | crossplane-fips-2.0 | 0 | 2.0.6-r2 |
| Chainguard | crossplane-fips-2.0-crank | 0 | 2.0.6-r1 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.3-r2 |
| Chainguard | crossplane-fips-2.1-crank | 0 | 2.1.3-r1 |
| Chainguard | docker-cli-buildx | 0 | 0.31.1-r2 |
| Chainguard | docker-credential-cgr | 0 | 0.2.183-r0 |
| Chainguard | falcoctl | 0 | 0.12.0-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.1-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r5 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r4 |
| Chainguard | flux-source-controller-iamguarded-compat | 0 | 1.7.4-r3 |
| Chainguard | gh | 0 | 2.83.2-r0 |
| Chainguard | gh-doc | 0 | 2.83.2-r0 |
| Chainguard | gitsign | 0 | 0.14.0-r0 |
| Chainguard | gitsign-config | 0 | 0.13.0-r7 |
| Chainguard | gitsign-credential-cache | 0 | 0.13.0-r7 |
| Chainguard | goreleaser | 0 | 2.13.3-r0 |
| Chainguard | image-factory | 0 | 0.9.0-r2 |
| Chainguard | image-factory-fips | 0 | 0.9.0-r2 |
| Chainguard | ko | 0 | 0.18.1-r0 |
| Chainguard | ko-fips | 0 | 0.18.1-r0 |
| Chainguard | kubescape | 0 | 3.0.47-r0 |
| Chainguard | kyverno-1.16 | 0 | 1.16.2-r2 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.2-r2 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-cleanup-controller-1.16 | 0 | 1.16.2-r2 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.2-r2 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.2-r2 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r1 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r26 |
| Chainguard | kyverno-notation-aws-compat | 0 | 1.1-r25 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r26 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno | 0 | 0.5.3-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-compat | 0 | 0.5.2-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-fips | 0 | 0.5.3-r1 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.2-r2 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r1 |
| Chainguard | neuvector-sigstore-interface | 0 | 0_git20251212-r0 |
| Chainguard | neuvector-sigstore-interface-fips | 0 | 0_git20251212-r0 |
| Chainguard | policy-controller | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-fips | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester-fips | 0 | 0.15.1-r0 |
| Chainguard | ratify-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-crds | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-crds | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-licensechecker | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-licensechecker-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-sbom | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-sbom-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-schemavalidator | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-schemavalidator-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-vulnerabilityreport | 0 | 1.4.0-r8 |
| Chainguard | ratify-fips-vulnerabilityreport-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-licensechecker | 0 | 1.4.0-r8 |
| Chainguard | ratify-licensechecker-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-sbom | 0 | 1.4.0-r8 |
| Chainguard | ratify-sbom-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-schemavalidator | 0 | 1.4.0-r8 |
| Chainguard | ratify-schemavalidator-compat | 0 | 1.4.0-r8 |
| Chainguard | ratify-vulnerabilityreport | 0 | 1.4.0-r8 |
| Chainguard | ratify-vulnerabilityreport-compat | 0 | 1.4.0-r8 |
| Chainguard | reports-server-compat | 0 | 0.1.5-r0 |
| Chainguard | sigstore-scaffolding | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-cloudsqlproxy | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-ctlog-createctconfig | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-ctlog-managectroots | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-ctlog-verifyfulcio | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-cloudsqlproxy | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-ctlog-createctconfig | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-ctlog-managectroots | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-ctlog-verifyfulcio | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-fulcio-createcerts | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-getoidctoken | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-rekor-createsecret | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-trillian-createdb | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-trillian-createtree | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-trillian-updatetree | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-tsa-createcertchain | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-tuf-createsecret | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fips-tuf-server | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-fulcio-createcerts | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-getoidctoken | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-rekor-createsecret | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-trillian-createdb | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-trillian-createtree | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-trillian-updatetree | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-tsa-createcertchain | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-tuf-createsecret | 0 | 0.7.31-r3 |
| Chainguard | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r3 |
| Chainguard | skaffold | 0 | 2.17.1-r0 |
| Chainguard | skaffold-fips | 0 | 2.17.1-r0 |
| Chainguard | spire-agent | 0 | 1.14.0-r1 |
| Chainguard | spire-agent-fips | 0 | 1.14.0-r1 |
| Chainguard | spire-oidc-discovery-provider | 0 | 1.14.0-r0 |
| Chainguard | spire-oidc-discovery-provider-fips | 0 | 1.14.0-r0 |
| Chainguard | spire-server | 0 | 1.14.0-r0 |
| Chainguard | spire-server-fips | 0 | 1.14.0-r0 |
| Chainguard | tekton-chains | 0 | 0.26.0-r3 |
| Chainguard | tekton-chains-fips | 0 | 0.26.0-r5 |
| Chainguard | teleport-15 | 0 | 15.5.4-r9 |
| Chainguard | teleport-15-kube-agent-updater-compat | 0 | 15.5.4-r9 |
| Chainguard | teleport-16 | 0 | 16.5.18-r5 |
| Chainguard | teleport-16-kube-agent-updater-compat | 0 | 16.5.18-r5 |
| Chainguard | teleport-16-operator | 0 | 16.5.18-r6 |
| Chainguard | teleport-16-operator-compat | 0 | 16.5.18-r6 |
| Chainguard | teleport-17-kube-agent-updater-compat | 0 | 17.7.12-r1 |
| Chainguard | teleport-17-operator-compat | 0 | 17.7.12-r2 |
| Chainguard | teleport-18-kube-agent-updater-compat | 0 | 18.6.0-r1 |
| Chainguard | teleport-18-operator-compat | 0 | 18.6.1-r1 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Chainguard | teleport-operator-17-compat-fips | 0 | 17.7.12-r0 |
| Chainguard | teleport-operator-18-compat-fips | 0 | 18.6.1-r0 |
| Chainguard | teleport-operator-fips-17 | 0 | 17.7.13-r1 |
| Chainguard | teleport-operator-fips-18 | 0 | 18.6.1-r1 |
| Chainguard | tflint | 0 | 0.60.0-r3 |
| Chainguard | tflint-compat | 0 | 0.60.0-r3 |
| Chainguard | tflint-fips | 0 | 0.60.0-r3 |
| Chainguard | tflint-fips-compat | 0 | 0.60.0-r3 |
| Chainguard | tkn | 0 | 0.43.0-r7 |
| Chainguard | tkn-fips | 0 | 0.43.0-r3 |
| Chainguard | trivy | 0 | 0 |
| Chainguard | trivy-fips | 0 | 0 |
| Chainguard | trivy-operator | 0 | 0 |
| Chainguard | trivy-operator-fips | 0 | 0 |
| Chainguard | vexctl | 0 | 0.4.1-r4 |
| Chainguard | witness | 0 | 0.10.1-r4 |
| Chainguard | zarf | 0 | 0.68.1-r0 |
| Chainguard | zot | 0 | 2.1.14-r0 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| Wolfi | aactl | 0 | 0.4.12-r43 |
| Wolfi | cosign | 0 | 3.0.3-r0 |
| Wolfi | cosign-fips | 0 | 3.0.3-r0 |
| Wolfi | crossplane-2.1 | 0 | 2.1.3-r2 |
| Wolfi | crossplane-2.1-crank | 0 | 2.1.3-r1 |
| Wolfi | docker-cli-buildx | 0 | 0.31.1-r2 |
| Wolfi | falcoctl | 0 | 0.12.0-r0 |
| Wolfi | flux-source-controller | 0 | 1.7.4-r5 |
| Wolfi | flux-source-controller-iamguarded-compat | 0 | 1.7.4-r3 |
| Wolfi | gh | 0 | 2.83.2-r0 |
| Wolfi | gh-doc | 0 | 2.83.2-r0 |
| Wolfi | gitsign | 0 | 0.14.0-r0 |
| Wolfi | gitsign-config | 0 | 0.13.0-r7 |
| Wolfi | gitsign-credential-cache | 0 | 0.13.0-r7 |
| Wolfi | goreleaser | 0 | 2.13.3-r0 |
| Wolfi | ko | 0 | 0.18.1-r0 |
| Wolfi | ko-fips | 0 | 0.18.1-r0 |
| Wolfi | kubescape | 0 | 3.0.47-r0 |
| Wolfi | kyverno-1.16 | 0 | 1.16.2-r2 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.2-r2 |
| Wolfi | kyverno-cleanup-controller-1.16 | 0 | 1.16.2-r2 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.2-r2 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.2-r2 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r26 |
| Wolfi | kyverno-notation-aws-compat | 0 | 1.1-r25 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.2-r2 |
| Wolfi | neuvector-sigstore-interface | 0 | 0_git20251212-r0 |
| Wolfi | policy-controller | 0 | 0.15.1-r0 |
| Wolfi | policy-controller-tester | 0 | 0.15.1-r0 |
| Wolfi | ratify-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-crds | 0 | 1.4.0-r8 |
| Wolfi | ratify-licensechecker | 0 | 1.4.0-r8 |
| Wolfi | ratify-licensechecker-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-sbom | 0 | 1.4.0-r8 |
| Wolfi | ratify-sbom-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-schemavalidator | 0 | 1.4.0-r8 |
| Wolfi | ratify-schemavalidator-compat | 0 | 1.4.0-r8 |
| Wolfi | ratify-vulnerabilityreport | 0 | 1.4.0-r8 |
| Wolfi | ratify-vulnerabilityreport-compat | 0 | 1.4.0-r8 |
| Wolfi | sigstore-scaffolding | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-cloudsqlproxy | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-ctlog-createctconfig | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-ctlog-managectroots | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-ctlog-verifyfulcio | 0 | 0.7.31-r3 |
| Wolfi | sigstore-scaffolding-fulcio-createcerts | 0 | 0.7.31-r3 |
Related vulnerabilities
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects aactl
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects aactl
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects aactl