CVE-2026-49835

Name of the Vulnerable Software and Affected Versions Sigstore Timestamp Authority versions prior to v2.0.7

Description An unauthenticated remote attacker can cause unbounded memory growth on the timestamp authority server. The issue occurs because the wrapMetrics middleware records the raw HTTP request path r.URL.Path and the raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors. Because this middleware executes before standard routing, it processes all incoming requests, including unmatched paths and arbitrary methods. The Prometheus library creates a permanent time-series entry for every unique label combination, allowing an attacker to exhaust system memory by sending requests with random paths or methods.

Recommendations Update to version v2.0.7 or later. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the server. Configure rate-limiting on the public interface to prevent the issuance of numerous unique requests in a short duration.