Vulnerability Description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Sigstore Timestamp Authority | < 2.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e4Patch
- https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0ProductRelease Notes
- https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2MitigationVendor Advisory
FAQ
What is CVE-2026-49835?
CVE-2026-49835 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Meth...
How severe is CVE-2026-49835?
CVE-2026-49835 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49835?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Sigstore Timestamp Authority.