Executive brief
The Sigstore Timestamp Authority, a service used to provide secure time-stamping for digital signatures, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a large number of requests with unique web addresses or unusual methods, causing the server to run out of memory and crash. This can disrupt the ability of users and automated systems to verify the timing and validity of signed software or documents.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Sigstore Timestamp Authority's 'wrapMetrics' middleware. The component records the raw HTTP request path (r.URL.Path) and method (r.Method) as Prometheus labels before routing occurs. Because Prometheus creates a permanent time-series entry for every unique label combination, an unauthenticated remote attacker can send requests with randomized paths (e.g., using UUIDs) or arbitrary HTTP methods to trigger unbounded memory growth. This eventually leads to an Out-of-Memory (OOM) condition and service failure. The issue is resolved in version 2.1.0 by implementing an allowlist for valid paths and methods.
Affected products
- sigstore timestamp-authority < 2.1.0
Timeline
- 2026-05-26: patched: Version 2.1.0 released
- 2026-07-17: disclosed: CVE-2026-49835 published