VDB
CVE-2026-49835
CVE-2026-49835
PUBLISHED
CVSS 5.9 MEDIUM
Reported by GitHub_M · Published July 17, 2026
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
Risk Scores
CVSS 3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| sigstore | timestamp-authority | < 2.1.0 |
| chainguard | image-factory-fips | 0 |
| wolfi | gitsign | 0 |
| chainguard | kyverno-1.17 | 0, 0 |
| wolfi | ratify | 0, 0 |
| chainguard | spire-server-fips | 0 |
| chainguard | policy-controller-fips | 0 |
| chainguard | tbot | 0 |
| chainguard | kyverno-fips-1.16 | 0 |
| chainguard | goreleaser | 0 |
| chainguard | teleport-operator-fips-17 | 0 |
| chainguard | reports-server | * |
| chainguard | trivy | 0 |
| chainguard | kubescape | 0 |
| wolfi | tflint | 0 |
| wolfi | kyverno-1.16 | 0 |
| chainguard | crossplane-fips-2.1 | 0 |
| chainguard | kubescape-server-fips | 0 |
| chainguard | crossplane-2.0 | 0 |
| chainguard | kyverno-1.18 | 0, 0 |
…and 66 more
Timeline
- Jun 30, 2026 CVE Published
- Jul 1, 2026 Security Advisory
- Jul 18, 2026 EPSS Score
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
References
- https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j x_refsource_CONFIRM
- https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5 x_refsource_MISC
- https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-49835 advisory
- https://github.com/advisories/GHSA-9c54-x2g4-v92j advisory