CVE-2026-49835 Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
An unauthenticated attacker can exhaust server memory by sending requests with random paths and methods, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49835?
CVE-2026-49835 is a medium-severity denial of service vulnerability in sigstore timestamp-authority, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-49835?
6 open source packages ship an affected version, including github.com/sigstore/timestamp-authority and github.com/sigstore/timestamp-authority/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sigstore/timestamp-authority Go | All versions | None |
github.com/sigstore/timestamp-authority Go | All versions to 1.2.9 | None |
github.com/sigstore/timestamp-authority Go | All versions to 1.2.9 | None |
github.com/sigstore/timestamp-authority/v2 Go | All versions | 2.1.0 |
github.com/sigstore/timestamp-authority/v2 Go | All versions | 2.1.0 |
github.com/sigstore/timestamp-authority/v2 Go | All versions | 2.1.0 |
Products include Linuxfoundation Sigstore Timestamp Authority.
How do I fix CVE-2026-49835?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49835 being exploited?
There is no known exploitation of CVE-2026-49835 in the wild and no public exploit code.
Other vulnerabilities in sigstore timestamp-authority
Sources
Also known as CLEANSTART-2026-MR47110, CLEANSTART-2026-NV69611, CLEANSTART-2026-ZX16649, DEBIAN-CVE-2026-49835, GHSA-9c54-x2g4-v92j, GO-2026-5851 and 67 more.