CVE-2026-49835

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49835
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49835.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49835
Aliases
Downstream
Related
Published
2026-07-17T18:16:41.764Z
Modified
2026-07-19T03:46:16.524743575Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
Details

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49835.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/sigstore/timestamp-authority

Affected ranges

Type
GIT
Repo
https://github.com/sigstore/timestamp-authority
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
506ec57b6ac2ea1e4739322e47453469425b69b5
Fixed
58ae149676e193d2dd7e7ee53f231b83fdd10fad
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.0"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.2.0
v0.2.1
v1.*
v1.0.0
v1.0.0-rc.0
v1.0.0-rc.1
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49835.json"