CVE-2026-49835: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-49835 is an out-of-memory (OOM) vulnerability in the Sigstore Timestamp Authority server caused by unbounded Prometheus metric label cardinality. An unauthenticated remote attacker can trigger unbounded memory growth by sending requests with arbitrary HTTP paths or methods, causing the server to exhaust system memory. The vulnerability affects github.com/sigstore/timestamp-authority versions ≤ 1.2.9 and github.com/sigstore/timestamp-authority/v2 versions ≤ 2.0.6. It was first published on May 26, 2026, and added to the GitHub Advisory Database on June 30, 2026. The CVSS v3.1 base score is 5.9 (Medium) (GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). The global wrapMetrics middleware in the Timestamp Authority server records the raw HTTP request path (r.URL.Path) and raw HTTP request method (r.Method) as Prometheus labels for latency and request count metric vectors. Because this middleware executes before routing — and therefore before any path validation — it processes all incoming requests, including those for unmatched paths (resulting in 404 responses) and arbitrary or malformed HTTP methods. The Prometheus library permanently registers a new time-series entry for every unique label combination, so an attacker flooding the server with requests containing random paths (e.g., /api/v1/timestamp/<uuid>) or random HTTP methods causes unbounded memory growth (GitHub Advisory, Sigstore Advisory).

Successful exploitation results in a denial-of-service condition through memory exhaustion on the Timestamp Authority server. There is no impact on confidentiality or data integrity — the attack exclusively targets availability. If the Timestamp Authority is part of a software supply chain signing pipeline (e.g., Sigstore-based artifact signing), its unavailability could disrupt code signing and verification workflows for dependent systems (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Sigstore Timestamp Authority server instances running github.com/sigstore/timestamp-authority/v2 ≤ 2.0.6 or github.com/sigstore/timestamp-authority ≤ 1.2.9.
2. Craft requests with random paths: Generate a large volume of HTTP requests targeting the server with unique, random path segments (e.g., GET /api/v1/timestamp/<random-uuid>) to create new Prometheus time-series entries for each unique path.
3. Craft requests with random HTTP methods: Supplement path-based flooding with requests using arbitrary or random HTTP method strings (e.g., FOOBAR /api/v1/timestamp) to further multiply unique label combinations.
4. Sustain the flood: Continuously issue these requests at high volume using tools such as curl, wrk, ab, or custom scripts. Each unique path/method combination causes the Prometheus library to permanently allocate a new time-series entry in memory.
5. Trigger OOM: As the number of unique label combinations grows, the server's memory is progressively exhausted, eventually causing an out-of-memory crash or severe degradation of the Timestamp Authority service (GitHub Advisory, Sigstore Advisory).

• Network: High volume of HTTP requests to the Timestamp Authority server with diverse, non-standard URL paths (e.g., /api/v1/timestamp/<random-string>) or unusual/invalid HTTP methods from one or more source IPs.
• Logs: Server access logs showing large numbers of 404 responses for varied, non-existent paths; repeated requests with non-standard HTTP methods (anything other than GET, POST, HEAD, OPTIONS).
• Process/System: Rapidly increasing memory consumption by the timestamp-authority process; OOM killer events in system logs (e.g., Linux dmesg or /var/log/syslog showing Out of memory: Kill process).
• Metrics: Prometheus metric cardinality explosion — an abnormally large number of unique label combinations in the http_request_duration_seconds or request count metric vectors (GitHub Advisory).

Users should upgrade to github.com/sigstore/timestamp-authority/v2 version v2.0.7 or later (also available as v2.1.0), which limits Prometheus metric label values to an allowlist of expected paths (/ping, /api/v1/timestamp, /api/v1/timestamp/certchain) and expected HTTP methods (GET, POST, HEAD, OPTIONS), normalizing all unrecognized values to the static string "unrecognized". As a workaround for those unable to upgrade immediately: (1) configure a reverse proxy or load balancer to block or drop requests with invalid HTTP methods or unknown paths before they reach the server, and (2) apply rate-limiting on the public interface to prevent high-volume flooding (GitHub Advisory, Sigstore Advisory).