Go/github.com/sigstore/timestamp-authority/v2 CVE-2026-49835: medium 5.9, EPSS 0.74%

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Action: Upgrade github.com/sigstore/timestamp-authority/v2 to 2.1.0 or later.

go get github.com/sigstore/timestamp-authority/v2@v2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-9c54-x2g4-v92j
• https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j
• https://github.com/sigstore/timestamp-authority

CVE-2026-49835 · published 2026-06-30T18:40:39Z · modified 2026-09-10T03:50:49.238907973Z · JSON