CVE-2026-49835 affects github.com/sigstore/timestamp-authority/v2 versions prior to v2.1.0 and up to 1.2.9. The vulnerability arises from the global wrapMetrics middleware recording raw HTTP request paths and methods as Prometheus labels before routing, including unmatched paths and arbitrary methods. Since Prometheus creates a new permanent time-series for each distinct label combination, an attacker can cause unbounded memory growth by sending requests with random paths or methods. The issue is fixed by limiting metric label values to an allowlist of expected paths (/ping, /api/v1/timestamp, /api/v1/timestamp/certchain) and HTTP methods (GET, POST, HEAD, OPTIONS), with unrecognized values normalized to "unrecognized". Users should upgrade to v2.0.7 or later. Additional mitigations include filtering invalid requests at a reverse proxy and rate limiting.

An unauthenticated remote attacker can cause a denial of service by exhausting the timestamp authority server's memory, leading to potential service disruption. There is no impact on confidentiality or integrity. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

A fix is available in version v2.0.7 and later, which limits metric label values to a strict allowlist and normalizes unrecognized values to prevent unbounded memory growth. Users should update to v2.0.7 or later. As workarounds, administrators can block or drop requests with invalid HTTP methods or unknown paths at a reverse proxy or load balancer, and implement rate limiting on the public interface to reduce the risk of memory exhaustion from high volumes of unique requests.