High severity · published Jul 17, 2026
CVE-2026-49835
Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
timestamp-authority · sigstore
< 2.1.0 · source: vendor
ST
Sigstore Timestamp Authority · Linuxfoundation
before 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49835
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49835
Patch
https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5
Product
https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0
Mitigation
https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j
More from timestamp-authority
5.5
CVE-2026-39984
Sigstore Timestamp Authority has Improper Certificate Validation in verifier