CVE-2025-66564 is a vulnerability classified under CWE-405 (Asymmetric Resource Consumption) affecting the sigstore timestamp-authority service, which issues RFC 3161 timestamps used in software supply chain security. The root cause lies in the handling of untrusted input data in two functions: api.ParseJSONRequest and api.getContentType. Specifically, api.ParseJSONRequest processes an optionally provided OID string by splitting it on periods using strings.Split, while api.getContentType splits the Content-Type header on an application string. Both inputs are attacker-controlled and can be crafted to contain excessively long strings with many delimiters. This causes the functions to allocate memory linearly proportional to the input length (O(n)), which can be exploited to consume disproportionate server resources. The vulnerability impacts availability by enabling denial-of-service attacks through resource exhaustion. It does not affect confidentiality or integrity, requires no privileges or user interaction, and can be triggered remotely over the network. The vulnerability was addressed and fixed in sigstore timestamp-authority version 2.0.3. No known exploits are currently reported in the wild, but the high CVSS score (7.5) reflects the ease of exploitation and potential impact on service availability.

For European organizations, the primary impact of CVE-2025-66564 is the risk of denial-of-service attacks against infrastructure components relying on the sigstore timestamp-authority service. This service is critical in software supply chain security, providing trusted timestamps for code signing and artifact verification. Disruption could delay or block software deployment pipelines, impacting development velocity and operational continuity. Organizations heavily invested in open source software development, continuous integration/continuous deployment (CI/CD) pipelines, or those that integrate sigstore for artifact verification are at heightened risk. The attack requires no authentication, increasing the threat surface. While no data confidentiality or integrity is compromised, availability degradation can have cascading effects on business operations and trust in software provenance. Additionally, the vulnerability could be leveraged as part of a broader attack chain targeting software supply chains, which are strategic assets in Europe’s digital economy.

European organizations should immediately upgrade all instances of sigstore timestamp-authority to version 2.0.3 or later, where this vulnerability is fixed. Until patching is complete, implement network-level protections such as rate limiting and input validation proxies to detect and block anomalously large or malformed OID and Content-Type header values. Monitoring and alerting on unusual spikes in memory or CPU usage on timestamp-authority servers can provide early warning of exploitation attempts. Employ Web Application Firewalls (WAFs) configured to inspect and limit header lengths and payload sizes. Incorporate this vulnerability into incident response playbooks to quickly isolate affected services if exploitation is suspected. Finally, review and harden software supply chain security policies to ensure timely updates of critical infrastructure components.