MEDIUM🇵🇱 Wersja polska

CVE-2026-49835

CVSS 5.9v3.1pub. 2026-07-17upd. 2026-07-30

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Linuxfoundation Sigstore Timestamp Authority

    APP
    Linuxfoundation
    < 2.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-66564HIGH7.5same product

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJ...

CVE-2026-39984MEDIUM5.5same product

Sigstore Timestamp Authority to usługa wydająca znaczniki czasu RFC 3161. Wersje 2.0.5 i wcześniejsze zawieraj...

CVE-2026-53488CRITICAL9.4PL ✓same vendor

containerd CRI plugin: brak walidacji etykiet obrazu umożliwia RCE na hoście

CVE-2026-44477CRITICAL9.4PL ✓same vendor

CloudNativePG: eskalacja uprawnień do superużytkownika PostgreSQL przez metrics exporter

CVE-2026-37531CRITICAL9.8PL ✓same vendor

AGL app-framework-main: Zip Slip + TOCTOU umożliwiają zapis dowolnych plików