Is CVE-2026-49835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49835 being exploited in the wild.

How severe is CVE-2026-49835?

Medium severity, with a CVSS score of 5.9, published 17 July 2026.

Which products and versions are affected?

github.com/sigstore/timestamp-authority (Go) <= 1.2.9, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.9; github.com/sigstore/timestamp-authority/v2 (Go) <= 2.0.6, SEMVER:introduced=0,fixed=2.1.0; Sigstore Timestamp-Authority < 2.1.0, <= 1.2.9, <= 2.0.6.

Is there a fix for CVE-2026-49835?

Yes. github.com/sigstore/timestamp-authority/v2 (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49835 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-49835?

Check whether you run github.com/sigstore/timestamp-authority (Go), github.com/sigstore/timestamp-authority/v2 (Go) or Sigstore Timestamp-Authority at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49835: Sigstore Timestamp Authority memory exhaustion in wrapMetrics middleware

Q: Is there a fix for CVE-2026-49835?

Yes. github.com/sigstore/timestamp-authority/v2 (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49835 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-49835?

Check whether you run github.com/sigstore/timestamp-authority (Go), github.com/sigstore/timestamp-authority/v2 (Go) or Sigstore Timestamp-Authority at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49835 · Severity: medium · CVSS 5.9 · Published 2026-07-17

The Sigstore Timestamp Authority, a service used to provide secure time-stamping for digital signatures, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a large number of requests with unique web addresses or unusual methods, causing the server to run out of memory and crash. This can disrupt the ability of users and automated systems to verify the timing and validity of signed software or documents.

Technologies: github.com/sigstore/timestamp-authority (Go), github.com/sigstore/timestamp-authority/v2 (Go). Vendors: Go, Sigstore.

Quick answers

Is CVE-2026-49835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49835 being exploited in the wild.
How severe is CVE-2026-49835?: Medium severity, with a CVSS score of 5.9, published 17 July 2026.
Which products and versions are affected?: github.com/sigstore/timestamp-authority (Go) <= 1.2.9, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.9; github.com/sigstore/timestamp-authority/v2 (Go) <= 2.0.6, SEMVER:introduced=0,fixed=2.1.0; Sigstore Timestamp-Authority < 2.1.0, <= 1.2.9, <= 2.0.6.
Is there a fix for CVE-2026-49835?: Yes. github.com/sigstore/timestamp-authority/v2 (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49835 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49835?: Check whether you run github.com/sigstore/timestamp-authority (Go), github.com/sigstore/timestamp-authority/v2 (Go) or Sigstore Timestamp-Authority at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/sigstore/timestamp-authority/v2 (Go): upgrade to 2.1.0 or later
```
go get github.com/sigstore/timestamp-authority/v2@v2.1.0
```

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Sigstore Timestamp Authority's 'wrapMetrics' middleware. The component records the raw HTTP request path (r.URL.Path) and method (r.Method) as Prometheus labels before routing occurs. Because Prometheus creates a permanent time-series entry for every unique label combination, an unauthenticated remote attacker can send requests with randomized paths (e.g., using UUIDs) or arbitrary HTTP methods to trigger unbounded memory growth. This eventually leads to an Out-of-Memory (OOM) condition and service failure. The issue is resolved in version 2.1.0 by implementing an allowlist for valid paths and methods.

Affected products

sigstore timestamp-authority < 2.1.0

Identifiers

CVE-2026-49835
GHSA-9c54-x2g4-v92j
GO-2026-5851

Timeline

2026-05-26: patched: Version 2.1.0 released
2026-07-17: disclosed: CVE-2026-49835 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.