CVE-2025-66564: 
Datadog Agent vulnerability analysis and mitigation

CVE-2025-66564 is a denial-of-service vulnerability in Sigstore Timestamp Authority caused by excessive memory allocation during API request parsing. It affects all versions up to and including 2.0.2 of the github.com/sigstore/timestamp-authority Go module. The vulnerability was disclosed on December 4, 2025, by researcher Hayden-IO via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory DB).

The root cause is classified as CWE-405 (Asymmetric Resource Consumption / Amplification). Two API functions are affected: api.ParseJSONRequest uses strings.Split to split an attacker-controlled OID field on period characters, and api.getContentType uses strings.Split on the Content-Type HTTP header against the string "application/". Because strings.Split in Go allocates a slice proportional to the number of delimiters found, a malicious request containing an arbitrarily long OID with many periods or a malformed Content-Type header causes O(n) memory allocations where n is the input length. The fix in commit 0cae34e adds a pre-check limiting OID sub-identifiers to 128 (per RFC 2578) and restricts Content-Type splitting to at most one occurrence using strings.Count and strings.SplitN (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated, remote attacker to exhaust the memory of the Sigstore Timestamp Authority service, potentially causing it to crash or become unavailable — a denial-of-service (DoS) condition. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Because Sigstore Timestamp Authority is used to issue RFC 3161 timestamps for software supply chain signing workflows, its unavailability could disrupt code signing and verification pipelines that depend on it (GitHub Advisory, Github Advisory DB).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04% (0.000400), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory DB, Feedly).

1. Reconnaissance: Identify publicly accessible Sigstore Timestamp Authority instances running versions ≤ 2.0.2, for example by scanning for the service's API endpoint (typically /api/v1/timestamp).
2. Craft malicious OID payload: Construct a JSON timestamp request body where the tsaPolicyOID field contains an excessively long string with hundreds or thousands of period characters (e.g., "1." + "0." * 10000).
3. Send request to ParseJSONRequest endpoint: Submit an HTTP POST request to the timestamp API endpoint with the crafted JSON body. The server's api.ParseJSONRequest function will call strings.Split on the OID, allocating O(n) memory.
4. Alternatively, craft malformed Content-Type header: Send an HTTP request with a Content-Type header containing many repetitions of the string "application/" (e.g., "application/application/application/...") to trigger unbounded allocation in api.getContentType.
5. Repeat to exhaust memory: Send many such requests in rapid succession to amplify memory pressure, ultimately causing the service process to exhaust available memory and crash or become unresponsive (GitHub Advisory, GitHub Commit).

• Network: High volume of HTTP POST requests to the Timestamp Authority API endpoint (e.g., /api/v1/timestamp) from one or more source IPs; requests with unusually large Content-Type headers or oversized JSON bodies.
• Logs: Server access logs showing repeated requests with tsaPolicyOID values containing abnormally long strings with many period characters; HTTP 400/500 error responses from the timestamp service following such requests.
• Process/System: Sudden spike in memory consumption by the timestamp-server process; out-of-memory (OOM) kill events in system logs (dmesg, /var/log/syslog) referencing the timestamp authority process; service restarts or crashes correlating with unusual request patterns.

The primary remediation is to upgrade Sigstore Timestamp Authority to version 2.0.3 or later, which enforces a maximum of 128 OID sub-identifiers and restricts Content-Type header splitting (GitHub Advisory). There is no in-service workaround; however, if the service is deployed behind a load balancer or reverse proxy, configuring it to reject requests with excessively large bodies or malformed headers can reduce exposure. Additionally, implementing rate limiting and request size restrictions at the network edge is recommended as a defense-in-depth measure (Github Advisory DB).