Medium 5.9Published Jul 17, 2026

CVE-2026-49835Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

Updated under an hour ago (Oct 27, 2026, 4:40 AM ET)

Does this affect you?

It affects sigstore timestamp-authority and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for sigstore timestamp-authority

Exploited in the last 30 days

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.

CVSS: 5.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Jul 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

sigstore timestamp-authority sigstore:timestamp_authority (from the name)	before 2.1.0	CNA record
linuxfoundation sigstore_timestamp_authority linuxfoundation:sigstore_timestamp_authority	before 2.1.0	NVD

References

References

https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j	x-refsource-confirm, mitigation, vendor-advisory
https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5	x-refsource-misc, patch
https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0	x-refsource-misc, product, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.