CVE-2025-66564: Sigstore Timestamp Authority allocates excessive memory during request parsing

December 5, 2025

Excessive memory allocation

References

github.com/advisories/GHSA-4qg8-fj49-pxjh
github.com/sigstore/timestamp-authority
github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421
github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh
nvd.nist.gov/vuln/detail/CVE-2025-66564

Code Behaviors & Features

Detect and mitigate CVE-2025-66564 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →