CVE-2026-49835: CWE-770: Allocation of Resources Without Limits or Throttling in sigstore timestamp-authority
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
AI Analysis
Technical Summary
The Sigstore Timestamp Authority server's middleware records raw HTTP request paths and methods as Prometheus metric labels before routing. This allows an attacker to generate a large number of unique label combinations, causing unbounded memory growth and potential OOM crashes. The vulnerability is tracked as CVE-2026-49835 and categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). It affects versions prior to v2.1.0 and up to and including 1.2.9. The issue is patched in version v2.0.7 by enforcing a strict allowlist of known paths and methods for metric labels and normalizing others to a static string, preventing unbounded cardinality.
Potential Impact
An unauthenticated remote attacker can cause the Sigstore Timestamp Authority server to exhaust system memory, leading to denial of service via out-of-memory conditions. There is no impact on confidentiality or integrity reported. The severity is moderate, reflecting the availability impact without direct data compromise.
Mitigation Recommendations
A fix is available in version v2.0.7 and later, which restricts Prometheus metric labels to a strict allowlist and normalizes unknown labels to prevent unbounded memory growth. Users should upgrade to v2.0.7 or later. As a workaround, blocking invalid requests at a proxy or applying rate limiting can mitigate the issue until the patch is applied.
CVE-2026-49835: CWE-770: Allocation of Resources Without Limits or Throttling in sigstore timestamp-authority
Description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Sigstore Timestamp Authority server's middleware records raw HTTP request paths and methods as Prometheus metric labels before routing. This allows an attacker to generate a large number of unique label combinations, causing unbounded memory growth and potential OOM crashes. The vulnerability is tracked as CVE-2026-49835 and categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). It affects versions prior to v2.1.0 and up to and including 1.2.9. The issue is patched in version v2.0.7 by enforcing a strict allowlist of known paths and methods for metric labels and normalizing others to a static string, preventing unbounded cardinality.
Potential Impact
An unauthenticated remote attacker can cause the Sigstore Timestamp Authority server to exhaust system memory, leading to denial of service via out-of-memory conditions. There is no impact on confidentiality or integrity reported. The severity is moderate, reflecting the availability impact without direct data compromise.
Mitigation Recommendations
A fix is available in version v2.0.7 and later, which restricts Prometheus metric labels to a strict allowlist and normalizes unknown labels to prevent unbounded memory growth. Users should upgrade to v2.0.7 or later. As a workaround, blocking invalid requests at a proxy or applying rate limiting can mitigate the issue until the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9c54-x2g4-v92j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49835"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4452e027e9c797198e109b
Added to database: 06/30/2026, 23:36:00 UTC
Last enriched: 07/18/2026, 11:19:05 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 42
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.