Bug 2499691 (CVE-2026-49835)

Summary: CVE-2026-49835 timestamp-authority: Sigstore Timestamp Authority: Denial of Service via unbounded metric label cardinality
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: eborisov, lball, ngough, veshanka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Sigstore Timestamp Authority. An unauthenticated remote attacker can exploit this vulnerability by sending requests with arbitrary HTTP paths and methods. This leads to the creation of an excessive number of unique metric labels, causing unbounded memory growth and a denial of service (DoS) condition on the server. This issue is a type of Improper Restriction of Resource Consumption (CWE-770).
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-13 14:40:38 UTC
The global wrapMetrics middleware in Sigstore Timestamp Authority records the raw HTTP request path and method as Prometheus labels. Since this runs before routing, unmatched paths and arbitrary methods create permanent time-series entries. An attacker can issue requests with random paths to exhaust system memory. Fixed in timestamp-authority v2.0.7/v2.1.0. Workaround: block invalid methods/paths at reverse proxy.