CVE-2026-49835: Sigstore Timestamp Authority DoS Vulnerability

CVE-2026-49835 Overview

CVE-2026-49835 affects Sigstore Timestamp Authority, a service that issues RFC 3161 timestamps used to attest software artifact signing events. The vulnerability exists in versions prior to 2.1.0. The global wrapMetrics middleware records raw HTTP request paths (r.URL.Path) and HTTP methods (r.Method) as Prometheus label values before routing. An unauthenticated remote attacker can send requests with arbitrary path segments or random HTTP methods to create unbounded permanent time-series entries. Each unique label combination allocates memory that Prometheus never reclaims, eventually exhausting the process heap. The maintainers fixed the issue in version 2.1.0 by bounding label cardinality [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Remote unauthenticated attackers can exhaust server memory by generating high-cardinality Prometheus metric labels, leading to denial of service of the timestamp authority.

Affected Products

Sigstore Timestamp Authority versions prior to 2.1.0
Deployments exposing the /metrics middleware to untrusted networks
Downstream Sigstore infrastructure relying on affected TSA instances

Discovery Timeline

2026-07-17 - CVE-2026-49835 published to NVD
2026-07-21 - Last updated in NVD database
Patch released - Sigstore Timestamp Authority v2.1.0 and GHSA-9c54-x2g4-v92j

Technical Details for CVE-2026-49835

Vulnerability Analysis

Sigstore Timestamp Authority instruments HTTP handlers with Prometheus metrics using a global middleware named wrapMetrics. The middleware records latency and request-count metric vectors keyed by the raw request path and method observed before routing. Prometheus client libraries maintain one time series per unique label tuple in process memory. Because the middleware accepts any value the client sends, an attacker controls the label space and can inflate it without bound. Each new unique path or method allocates a new series that persists for the lifetime of the process. Sustained request volume rapidly exhausts memory and forces the service to crash or become unresponsive. The impact is limited to availability since no authentication data or timestamp integrity is affected.

Root Cause

The root cause is missing validation and normalization of user-controlled inputs used as Prometheus label values. High-cardinality labels are a well-documented anti-pattern in Prometheus instrumentation. The vulnerable code path recorded r.URL.Path before the router matched a route template, so requests such as /api/v1/timestamp/<random-uuid> produced a new series per request instead of collapsing to the parameterized route /api/v1/timestamp/{id}. The same defect applied to r.Method, allowing arbitrary verbs like FOO or BAR to add new label values.

Attack Vector

Exploitation requires only network reachability to the timestamp authority HTTP endpoint. No credentials, user interaction, or elevated privileges are needed. An attacker sends a stream of HTTP requests, each containing a unique random path segment or an uncommon HTTP method. Each request expands the internal Prometheus registry until the process exceeds available memory.

// Excerpt from the v2.1.0 patch in
// pkg/generated/restapi/configure_timestamp_server.go
if maxRequestBodySize > uint64(math.MaxInt64) {
    log.Logger.Fatalf("max-request-body-size (%v) exceeds supported maximum (%v)", maxRequestBodySize, maxInt64Limit)
}
// #nosec G115
r.Body = http.MaxBytesReader(w, r.Body, int64(maxRequestBodySize))

Source: sigstore/timestamp-authority commit 506ec57. The complete patch bounds path and HTTP method metric label cardinality to prevent out-of-memory conditions.

Detection Methods for CVE-2026-49835

Indicators of Compromise

Steady growth of resident memory (RSS) in the timestamp-server process without a corresponding increase in legitimate signing traffic
Prometheus scrape responses returning large numbers of series for http_request_duration_seconds or request-count metrics with unique path labels
Access logs showing many requests to nonexistent paths under /api/v1/timestamp/ with random segments
Access logs containing uncommon HTTP methods such as FOO, PROPFIND, or random tokens

Detection Strategies

Query the Prometheus registry cardinality endpoint or /metrics output and alert when unique label combinations for path or method exceed a defined threshold
Compare route templates known to the OpenAPI spec against observed path label values and flag unmatched entries
Baseline HTTP method distributions and alert on methods outside the documented set (GET, POST)

Monitoring Recommendations

Track process memory and goroutine counts on TSA hosts with alerting on sustained upward trends
Enable request-rate anomaly detection at the ingress layer or WAF in front of the timestamp authority
Forward TSA access logs to a centralized analytics platform to correlate cardinality spikes with source IP addresses

How to Mitigate CVE-2026-49835

Immediate Actions Required

Upgrade Sigstore Timestamp Authority to version 2.1.0 or later on all deployments
Restrict /metrics exposure to internal monitoring networks and block external access via network policy or ingress rules
Rate-limit requests to the TSA HTTP endpoints at the load balancer or API gateway
Restart the timestamp-server process after upgrade to clear any accumulated high-cardinality series

Patch Information

The fix landed in sigstore/timestamp-authority v2.1.0 via commit 506ec57. The patch bounds path and HTTP method metric label cardinality so that unknown routes and non-standard methods collapse into fixed-value labels. Full advisory details are available in GHSA-9c54-x2g4-v92j.

Workarounds

Terminate TLS at a reverse proxy that enforces an allow-list of HTTP methods (GET, POST) and rejects requests with unknown path prefixes
Configure ingress rate limits per source IP address to slow cardinality inflation while an upgrade is scheduled
Restart the timestamp authority on a scheduled cadence to reclaim memory as a temporary measure until the patched version is deployed

bash

# Example NGINX ingress snippet restricting methods and path prefix
location /api/v1/timestamp/ {
    limit_except GET POST { deny all; }
    limit_req zone=tsa_zone burst=20 nodelay;
    proxy_pass http://timestamp_authority_upstream;
}