{"id":"CVE-2026-49835","revision":null,"records":[{"revision":"34019faa66f94464b1df8a4c6bc1f55e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49835","aliases":[],"title":"Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality","description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.","state":0,"publishedAt":"2026-07-17T18:16:41.764+00:00","modifiedAt":"2026-07-17T19:45:44.026+00:00","affected":[{"ecosystem":"Vendor product","name":"timestamp-authority","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sigstore\",\n                    \"product\": \"timestamp-authority\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j","https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5","https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49835","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49835","identifiers":["CVE-2026-49835"]},"retained":false,"historicalAffected":[]},{"revision":"bcbba2242c734a6684b49f462c5b11f0","observedAt":"2026-10-25T12:17:38.331+00:00","statement":{"source":"nvd","id":"CVE-2026-49835","aliases":[],"title":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and …","description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.","state":0,"publishedAt":"2026-07-17T19:17:16.227+00:00","modifiedAt":"2026-10-24T20:10:00.137+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5","https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0","https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49835","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:linuxfoundation:sigstore_timestamp_authority:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-17T19:17:16.227","lastModified":"2026-10-24T20:10:00.137"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-49835","identifiers":["CVE-2026-49835"]},"retained":false,"historicalAffected":[]},{"revision":"f6c6a28d36ad4561ac84bd45041bd1e5","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9c54-x2g4-v92j","aliases":["CVE-2026-49835","GO-2026-5851"],"title":"Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality","description":"### Impact\n\nAn unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server.\n\nThis vulnerability exists because the global `wrapMetrics` middleware records the raw HTTP request path (`r.URL.Path`) and raw HTTP request method (`r.Method`) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g., `/api/v1/timestamp/<uuid>`) or random HTTP methods to exhaust system memory.\n\n### Patches\n\nThis issue has been patched by limiting the metric label values to a strict allowlist of expected paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and expected HTTP methods (`GET`, `POST`, `HEAD`, `OPTIONS`). Unrecognized paths or methods are normalized to a static string (`\"unrecognized\"`).\n\nUsers should update to version `v2.0.7` or later.\n\n### Workarounds\n\n1. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the timestamp authority server.\n2. Configure rate-limiting on the public interface to prevent remote attackers from issuing millions of unique requests in a short duration.","state":0,"publishedAt":"2026-06-30T18:40:39+00:00","modifiedAt":"2026-09-10T03:50:49.238908+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/timestamp-authority/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.1.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/sigstore/timestamp-authority","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.2.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j","https://github.com/sigstore/timestamp-authority"],"sourceUrl":"https://github.com/advisories/GHSA-9c54-x2g4-v92j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9c54-x2g4-v92j","identifiers":["GHSA-9c54-x2g4-v92j","CVE-2026-49835","GO-2026-5851"]},"retained":false,"historicalAffected":[]},{"revision":"f5fd7caa918a4552b8bcdc2c3b71c09c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5851","aliases":["CVE-2026-49835","GHSA-9c54-x2g4-v92j"],"title":"Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority","description":"Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-08T15:29:24.0851263+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/timestamp-authority","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/sigstore/timestamp-authority/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5851","license":"OSV · upstream source license applies","key":"osv:GO-2026-5851","identifiers":["GO-2026-5851","CVE-2026-49835","GHSA-9c54-x2g4-v92j"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0403366+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0403386+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-44adb5fc4ec2447b4a14a9a186d21f635f5ab0fe59c9ca03fbd7387196ed1b95","complete":true,"records":414861,"lastAttemptAt":"2026-10-27T04:23:19.4839227+00:00","lastSuccessAt":"2026-10-27T04:23:19.4592214+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.4839227+00:00","snapshotPublishedAt":"2026-10-27T03:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T04:24:29.5120624+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0415276+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0415281+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1e75823a9a3a4b74973abff44e356610","complete":false,"records":13416,"lastAttemptAt":"2026-10-27T04:24:27.4557647+00:00","lastSuccessAt":"2026-10-27T04:24:27.452+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:24:27.452+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13077,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T04:23:20.1429206+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.1429206+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T04:23:19.6550338+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.6550338+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T04:23:20.5252815+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.5252815+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2c2579bb03487537529e2b647fd2d9950cfc0fec1a9832dba33e322b8dcbe369","complete":true,"records":230812,"lastAttemptAt":"2026-10-27T04:23:20.0379863+00:00","lastSuccessAt":"2026-10-26T21:37:26.5810298+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.0379863+00:00","snapshotPublishedAt":"2026-10-26T21:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}