Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an OOM (Out of Memory) issue in the Sigstore Timestamp Authority caused by unbounded metric label cardinality. The root cause is in the wrapMetrics middleware function located in pkg/generated/restapi/configure_timestamp_server.go. This function collects and exposes Prometheus metrics for HTTP requests. The vulnerable code uses the raw HTTP request path and method directly as labels for these metrics. Since an unauthenticated attacker can send requests with arbitrary and unique paths and methods, this leads to the creation of an ever-increasing number of metric time-series, consuming all available memory on the server.
The patch for this vulnerability, found in commit 506ec57b6ac2ea1e4739322e47453469425b69b5, introduces input validation. It checks the request path and method against an allowlist of expected values. If a path or method is not in the allowlist, it is replaced with the static string "unrecognized". This change effectively bounds the number of possible label combinations, preventing the OOM condition and mitigating the vulnerability.
wrapMetricspkg/generated/restapi/configure_timestamp_server.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/sigstore/timestamp-authority/v2 | go | <= 2.0.6 | 2.1.0 |
| github.com/sigstore/timestamp-authority | go | <= 1.2.9 |