CVE-2026-49835
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in Sigstore Timestamp Authority before version 2.1.0 allows an unauthenticated remote attacker to send requests with random paths or HTTP methods, causing unbounded permanent time-series entries in Prometheus metrics and leading to memory exhaustion.
Risk Assessment
The attack can cause server memory exhaustion, resulting in denial of service (DoS) and preventing the issuance of RFC 3161 timestamps, disrupting systems dependent on Sigstore.
Recommendation
Immediately upgrade Sigstore Timestamp Authority to version 2.1.0 or later, which includes a fix that restricts metric recording to safe values.
Other vulnerabilities in Sigstore Timestamp Authority
Original NVD description (English source)
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS