CVE-2026-49835 sigstore CVE debrief

Who should care

Users of Sigstore Timestamp Authority prior to version 2.1.0 should review and update their installations. This includes operators, administrators, and security teams responsible for maintaining and securing systems that utilize Sigstore Timestamp Authority. Additionally, vulnerability management teams should assess the potential impact and prioritize updates or mitigations.

Technical summary

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path and raw HTTP request method as Prometheus labels for latency and request count metric vectors before routing. This allows an unauthenticated remote attacker to issue requests with random paths or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. The issue is fixed in version 2.1.0.

Defensive priority

Medium priority given the CVSS score of 5.9 and the potential for memory exhaustion.

Recommended defensive actions

• Update Sigstore Timestamp Authority to version 2.1.0 or later
• Review and restrict access to the Sigstore Timestamp Authority service
• Monitor for unusual activity and memory usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is based on the CVE record and NVD detail. Limited information is available on the attack vector and potential impact. The CVE record was published on 2026-07-17T19:17:16.227Z and has not been modified since then. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path and raw HTTP request method as Prometheus labels for latency and request count metric vectors before routing. This allows an unauthenticated remote attacker to issue requests with random paths or random HTTP methods and create unbounded permanent time-series entries that exhaust memory.

Official resources