CVE-2026-49835
Medium
Description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
SeverityMedium
CVSS5.9
Exploit probability—
ProductLinuxfoundation Sigstore Timestamp Authority
PublishedJul 17, 2026
First seenJul 17, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- linuxfoundation sigstore_timestamp_authority2.1.0 or later
- github.com/sigstore/timestamp-authority/v22.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation sigstore_timestamp_authority | v < 2.1.0 | 2.1.0 |
| github.com/sigstore/timestamp-authority/v2Go | v < 2.1.0 | 2.1.0 |
| github.com/sigstore/timestamp-authorityGo | v ≤ 1.2.9, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.