# CVE-2026-49835: Sigstore Timestamp Authority memory exhaustion in wrapMetrics middleware

Source: https://junglewise.ai/threats/cve-2026-49835-sigstore-timestamp-authority-memory-exhaustion-in-wrapmetrics  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-49835 · Severity: medium · CVSS 5.9 · Published 2026-07-17

The Sigstore Timestamp Authority, a service used to provide secure time-stamping for digital signatures, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a large number of requests with unique web addresses or unusual methods, causing the server to run out of memory and crash. This can disrupt the ability of users and automated systems to verify the timing and validity of signed software or documents.

Technologies: [github.com/sigstore/timestamp-authority (Go)](https://junglewise.ai/threats/technologies/github-com-sigstore-timestamp-authority), [github.com/sigstore/timestamp-authority/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-sigstore-timestamp-authority-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sigstore](https://junglewise.ai/threats/vendors/sigstore).

## Quick answers

**Is CVE-2026-49835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49835 being exploited in the wild.

**How severe is CVE-2026-49835?** Medium severity, with a CVSS score of 5.9, published 17 July 2026.

**Which products and versions are affected?** github.com/sigstore/timestamp-authority (Go) <= 1.2.9, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.9; github.com/sigstore/timestamp-authority/v2 (Go) <= 2.0.6, SEMVER:introduced=0,fixed=2.1.0; Sigstore Timestamp-Authority < 2.1.0, <= 1.2.9, <= 2.0.6.

**Is there a fix for CVE-2026-49835?** Yes. github.com/sigstore/timestamp-authority/v2 (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49835 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49835?** Check whether you run github.com/sigstore/timestamp-authority (Go), github.com/sigstore/timestamp-authority/v2 (Go) or Sigstore Timestamp-Authority at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/sigstore/timestamp-authority/v2 (Go): upgrade to 2.1.0 or later

  ```sh
  go get github.com/sigstore/timestamp-authority/v2@v2.1.0
  ```


## Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Sigstore Timestamp Authority's 'wrapMetrics' middleware. The component records the raw HTTP request path (r.URL.Path) and method (r.Method) as Prometheus labels before routing occurs. Because Prometheus creates a permanent time-series entry for every unique label combination, an unauthenticated remote attacker can send requests with randomized paths (e.g., using UUIDs) or arbitrary HTTP methods to trigger unbounded memory growth. This eventually leads to an Out-of-Memory (OOM) condition and service failure. The issue is resolved in version 2.1.0 by implementing an allowlist for valid paths and methods.

## Affected products

- sigstore timestamp-authority < 2.1.0

## Identifiers

- CVE-2026-49835
- GHSA-9c54-x2g4-v92j
- GO-2026-5851

## Timeline

- 2026-05-26: patched: Version 2.1.0 released
- 2026-07-17: disclosed: CVE-2026-49835 published

## References

- [https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5](https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5)
- [https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0](https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0)
- [https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j](https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j)

## Related threats

- [Sigstore Timestamp Authority has Improper Certificate Validation in verifier](https://junglewise.ai/threats/cve-2026-39984-sigstore-timestamp-authority-has-improper-certificate-validation)
- [Sigstore Timestamp Authority allocates excessive memory during request parsing](https://junglewise.ai/threats/cve-2025-66564-sigstore-timestamp-authority-allocates-excessive-memory-during)