Threats Tagged 'cve-2026-49835'

The Sigstore Timestamp Authority server has a vulnerability where an unauthenticated remote attacker can cause unbounded memory growth by exploiting how HTTP request paths and methods are recorded as Prometheus metric labels. This occurs because the middleware records raw request paths and methods before routing, creating a new time-series entry for every unique label combination, which can exhaust system memory. The issue is patched in version v2.0.7 by restricting metric labels to a strict allowlist of known paths and methods, normalizing others to a static string. Workarounds include blocking invalid requests at a proxy or applying rate limiting.