Sigstore Timestamp Authority vulnerabilities

2 known vulnerabilities in Sigstore Timestamp Authority from Linux Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  timestamp-authority: Allocation of Resources Without Limits or Throttling

  CVE-2026-49835Jul 17, 2026Sigstore

  Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric

• 7.5 High severity

  timestamp-authority: Asymmetric Resource Consumption (Amplification)

  CVE-2025-66564Dec 4, 2025Sigstore

  Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.get