A vulnerability in the Sigstore Timestamp Authority allows unauthenticated remote attackers to cause a denial of service through asymmetric memory consumption.

The application incorrectly handles untrusted input within the OID payload and Content-Type header by performing excessive memory allocations during string splitting operations. This allows an unauthenticated attacker to trigger significant resource exhaustion via a maliciously crafted request.

Successful exploitation of this vulnerability results in a denial of service for the Sigstore Timestamp Authority, rendering the service unavailable for legitimate operations. Given the critical role of timestamping in supply chain security and code signing, this disruption could halt automated pipelines and security verification processes. With a CVSS score of 7.5, the high impact on service availability necessitates prioritized remediation.

Immediate Action: Update the Sigstore Timestamp Authority service to version 2.0.3 or later to incorporate the necessary input validation and memory allocation fixes.

Proactive Monitoring: Monitor service logs and system metrics for spikes in memory utilization or frequent 500-series errors associated with incoming HTTP requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests containing abnormally long OID strings or malformed Content-Type headers until the patch is applied.

Public Exploit Available: No (exploit_available unknown)

This vulnerability presents a clear risk to service availability and should be addressed promptly. Administrators should prioritize the update to version 2.0.3 across all production instances to ensure the service remains resilient against resource exhaustion attacks. Failure to patch may expose critical signing infrastructure to unnecessary disruption.