GHSA-XM5M-WGH2-RRG3 Sigstore Timestamp Authority has Improper Certificate Validation in verifier

Authorization bypass via certificate bag manipulation in sigstore/timestamp-authority verifier An authorization bypass vulnerability exists in sigstore/timestamp-authority verifier timestamp-authority/v2/pkg/verification: VerifyTimestampResponse function correctly verifies the certificate chain b...

EUVD-2026-22813

Sigstore Timestamp Authority has Improper Certificate Validation in verifier...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nri-f5, pulumi, rook, cert-manager-csi-driver, cilium-cli, kubernetes-dashboard-metrics-scraper, cis-operator, flux, argocd-image-updater, polaris, vertical-pod-autoscaler, filebrowser, cluster-api-ipam-provider-in-cluster, custom-pod-autoscaler-operator,...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through the Verifier.verifyleafcerts logic in src/rfc3161client/verify.py. An attacker can make a timestamp response from a trusted TSA verify as if it came from a different pinned TSA by injecting...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: harbor-registry-fips, apko-fips, omni-fips, spicedb-fips, google-guest-agent-manager, flux-operator, falcosidekick, grafana-mimir-fips, grafana-mimir, temporal, commercial-chainloop-cli, peerdb-flow, openbao-fips, crossplane-fips, elastic-agent, skopeo-fips,...

Denial Of Service (DoS)

github.com/sigstore/timestamp-authority is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient processing of untrusted input using string splitting in request parsing functions, which allows an attacker to send crafted inputs that trigger excessive memory allocations and...

SUSE CVE-2026-24122

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...

CVE-2026-24122

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...

CVE-2026-24122

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: trillian, chezmoi, telegraf, splunk-otel-collector, age, ratify, amass, sftpgo-plugin-eventstore, ksops, terragrunt, dbmate, temporal, kubeflow-pipelines, k3s, kots, nri-mysql, temporal-server, kine, flux-kustomize-controller, wolfictl, db-operator,...

CVE-2025-47908 vulnerabilities

Vulnerabilities for packages: rekor, timestamp-authority, cortex, prometheus-alertmanager, grafana-mimir, fulcio...

SUSE CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

A flaw was found in Sigstore Timestamp Authority. This vulnerability allows a denial of service via excessive memory allocation when processing a specially crafted Object Identifier or Content-Type header...

GO-2025-4192 Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority

Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority...

Linux Distros Unpatched Vulnerability : CVE-2025-66564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the api.ParseJSONRequest or api.getContentType functions. An attacker can cause excessive memory consumption by sending requests with either an excessively long OID containing man...

GHSA-4QG8-FJ49-PXJH Sigstore Timestamp Authority allocates excessive memory during request parsing

Impact Excessive memory allocation Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type header which is also untrusted data on an application string...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the api.ParseJSONRequest or api.getContentType functions. An attacker can cause excessive memory consumption by sending requests with either an excessively long OID containing man...

EUVD-2025-201319

Sigstore Timestamp Authority allocates excessive memory during request parsing...

DEBIAN-CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...