What is CVE-2026-49835?

CVE-2026-49835 is a medium-severity vulnerability in Sigstore Timestamp-authority, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.9/10. Published 2026-07-17.

How severe is CVE-2026-49835?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Resource exhaustion in Sigstore Timestamp-authority

CVE-2026-49835

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and…

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Sigstore Timestamp-authority — versions < 2.1.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-49835?: CVE-2026-49835 is a medium-severity vulnerability in Sigstore Timestamp-authority, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.9/10. Published 2026-07-17.
How severe is CVE-2026-49835?: Medium severity. CVSS v3 base score is 5.9 out of 10.