Answer in brief
CVE-2026-49835 records a Medium severity (CVSS 5.9) vulnerability in Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority. The current sources do not mark it as known exploited. The current feed maps github.com/sigstore/timestamp-authority (go), github.com/sigstore/timestamp-authority (go), github.com/sigstore/timestamp-authority/v2 (go), github.com/sigstore/timestamp-authority/v2 (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/sigstore/timestamp-authority (go), github.com/sigstore/timestamp-authority (go), github.com/sigstore/timestamp-authority/v2 (go), github.com/sigstore/timestamp-authority/v2 (go). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:linuxfoundation:sigstore_timestamp_authority:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/sigstore/timestamp-authoritygo | <=1.2.9 | Not reported |
| github.com/sigstore/timestamp-authoritygo | >=0 | Not reported |
| github.com/sigstore/timestamp-authority/v2go | <=2.0.6 | 2.1.0 |
| github.com/sigstore/timestamp-authority/v2go | >=0 <2.1.0 | 2.1.0 |
Published upstream
Jun 30, 2026
Evidence: source:nvd:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:nvd:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
### Impact An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server. This vulnerability exists because the global `wrapMetrics` middleware records the raw HTTP request path (`r.URL.Path`) and raw HTTP request method (`r.Method`) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g., `/api/v1/timestamp/<uuid>`) or random HTTP methods to exhaust system memory. ### Patches This issue has been patched by limiting the metric label values to a strict allowlist of expected paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and expected HTTP methods (`GET`, `POST`, `HEAD`, `OPTIONS`). Unrecognized paths or methods are normalized to a static string (`"unrecognized"`). Users should update to version `v2.0.7` or later. ### Workarounds 1. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the timestamp authority server. 2. Configure rate-limiting on the public interface to prevent remote attackers from issuing millions of unique requests in a short duration.
Quoted source text, attributed separately from HOL analysis.