【中危】v2 安全更新（GHSA-9c54-x2g4-v92j）

安全情报快照 · 风险级别：中危 · CVSS：5.9 · CVE-2026-49835 · GHSA-9c54-x2g4-v92j

先看结论

v2存在安全风险，<= 2.0.6 受影响，建议升级至 2.1.0。

影响范围

处置建议

优先将 github.com/sigstore/timestamp-authority/v2 升级至 2.1.0 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Impact

An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server.

This vulnerability exists because the global wrapMetrics middleware records the raw HTTP request path (r.URL.Path) and raw HTTP request method (r.Method) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g., /api/v1/timestamp/<uuid>) or random HTTP methods to exhaust system memory.

Patches

This issue has been patched by limiting the metric label values to a strict allowlist of expected paths (/ping, /api/v1/timestamp, /api/v1/timestamp/certchain) and expected HTTP methods (GET, POST, HEAD, OPTIONS). Unrecognized paths or methods are normalized to a static string ("unrecognized").

Users should update to version v2.0.7 or later.

Workarounds

1. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the timestamp authority server.
2. Configure rate-limiting on the public interface to prevent remote attackers from issuing millions of unique requests in a short duration.

来源与许可

• GitHub Advisory GHSA-9c54-x2g4-v92j
• https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。