What’s Vulnerable › Vulnerabilities

CVE-2026-49835: Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-17 · updated 2026-10-24
• Weakness: CWE-770

Description

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.

Affected products

• sigstore timestamp-authority: before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: sigstore timestamp-authority 2.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5
• https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0
• https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j

Get alerted when CVE-2026-49835 or the next vulnerability affects your stack