CVE-2026-49835: Microsoft APM unbounded metrics

Q: Is CVE-2026-49835 actively exploited?

No confirmed active exploitation of CVE-2026-49835 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-49835?

1) Upgrade to `github.com/sigstore/timestamp-authority/v2` v2.0.7 or later, which restricts Prometheus metric labels to an allowlist of known paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and methods (GET, POST, HEAD, OPTIONS), normalizing everything else to `"unrecognized"`. 2) If immediate patching isn't feasible, block or drop requests with invalid paths/methods at a reverse proxy or load balancer in front of the TSA service. 3) Apply rate limiting on the public interface to cap the rate of unique requests an attacker can generate. 4) Monitor Prometheus/Grafana for unbounded growth in time-series cardinality on the affected metric vectors and set alerting on TSA process memory usage as a leading indicator of an active attempt.

Q: What systems are affected by CVE-2026-49835?

This vulnerability affects the following AI/ML architecture patterns: CI/CD supply-chain signing infrastructure, model/artifact provenance and attestation pipelines, MLOps build pipelines relying on trusted timestamping.

Q: What is the CVSS score for CVE-2026-49835?

CVE-2026-49835 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.45%.

CISO Take

A missing allowlist on the Prometheus instrumentation in Sigstore's timestamp authority server lets any unauthenticated attacker turn ordinary HTTP noise into permanent memory consumption, because every distinct request path or method gets recorded as a brand-new metric label combination. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, but the barrier to entry is trivial — this requires nothing more than a script firing requests with randomized paths (e.g. UUIDs) or bogus HTTP verbs at a public endpoint, no authentication or AI/ML expertise needed. The blast radius in our tracked dependency graph is currently 0, but timestamp authorities sit in software supply-chain signing/provenance flows (Sigstore/cosign/SLSA-style attestations), so an outage here can stall artifact- or model-signing pipelines that depend on it for trusted timestamps. Patch to v2.0.7+ (module `github.com/sigstore/timestamp-authority/v2`) immediately; if same-day patching isn't possible, put the service behind a reverse proxy/WAF that strips unrecognized paths and methods before they reach the app, and apply rate limiting on the public interface as an interim control. Detection-wise, watch Prometheus for anomalous label cardinality growth on the `wrapMetrics` vectors or sudden memory growth on the TSA process as an early indicator this is being actively probed.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) — availability-only impact with no confidentiality or integrity loss. The CVSS AC:H rating reflects the need for sustained request volume to exhaust memory, but the actual mechanics are trivial to automate: no authentication, no special crafting, just a loop of randomized paths or HTTP methods. No EPSS score, no CISA KEV entry, no public exploit code, and no Nuclei template exist yet, so there's no evidence of active exploitation in the wild. Current downstream dependent count is 0 in our tracked graph, which caps observable blast radius today, but the package has 6 other known CVEs, suggesting it receives ongoing security scrutiny and attacker attention as supply-chain-critical infrastructure. Overall exploitability is high (unauthenticated, low complexity in practice) but severity is bounded to a service-availability DoS rather than data compromise.

How does the attack unfold?

Initial Access

Unauthenticated attacker sends HTTP requests directly to the public-facing timestamp authority endpoint.

AML.T0049

Exploitation

Requests use randomized paths or nonstandard HTTP methods, which the wrapMetrics middleware records unfiltered as new Prometheus label combinations before routing occurs.

Resource Exhaustion

Each unique label combination creates a permanent time-series entry, causing unbounded and continuous memory growth on the server.

Impact

The TSA process runs out of memory or becomes unresponsive, denying trusted timestamp issuance to legitimate supply-chain signing clients.

AML.T0029

Initial Access

Unauthenticated attacker sends HTTP requests directly to the public-facing timestamp authority endpoint.

AML.T0049

Exploitation

Requests use randomized paths or nonstandard HTTP methods, which the wrapMetrics middleware records unfiltered as new Prometheus label combinations before routing occurs.

Resource Exhaustion

Each unique label combination creates a permanent time-series entry, causing unbounded and continuous memory growth on the server.

Impact

The TSA process runs out of memory or becomes unresponsive, denying trusted timestamp issuance to legitimate supply-chain signing clients.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Microsoft APM	go	<= 1.2.9	No patch
3.5K Pushed 3d ago 67% patched ~7d to patch Full package profile →
Microsoft APM	go	<= 2.0.6	`2.1.0`
3.5K Pushed 3d ago 67% patched ~7d to patch Full package profile →

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Upgrade to github.com/sigstore/timestamp-authority/v2 v2.0.7 or later, which restricts Prometheus metric labels to an allowlist of known paths (/ping, /api/v1/timestamp, /api/v1/timestamp/certchain) and methods (GET, POST, HEAD, OPTIONS), normalizing everything else to "unrecognized". 2) If immediate patching isn't feasible, block or drop requests with invalid paths/methods at a reverse proxy or load balancer in front of the TSA service. 3) Apply rate limiting on the public interface to cap the rate of unique requests an attacker can generate. 4) Monitor Prometheus/Grafana for unbounded growth in time-series cardinality on the affected metric vectors and set alerting on TSA process memory usage as a leading indicator of an active attempt.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1 - Risk monitoring and response for deployed AI systems and supporting infrastructure

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2026-49835?

A missing allowlist on the Prometheus instrumentation in Sigstore's timestamp authority server lets any unauthenticated attacker turn ordinary HTTP noise into permanent memory consumption, because every distinct request path or method gets recorded as a brand-new metric label combination. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, but the barrier to entry is trivial — this requires nothing more than a script firing requests with randomized paths (e.g. UUIDs) or bogus HTTP verbs at a public endpoint, no authentication or AI/ML expertise needed. The blast radius in our tracked dependency graph is currently 0, but timestamp authorities sit in software supply-chain signing/provenance flows (Sigstore/cosign/SLSA-style attestations), so an outage here can stall artifact- or model-signing pipelines that depend on it for trusted timestamps. Patch to v2.0.7+ (module `github.com/sigstore/timestamp-authority/v2`) immediately; if same-day patching isn't possible, put the service behind a reverse proxy/WAF that strips unrecognized paths and methods before they reach the app, and apply rate limiting on the public interface as an interim control. Detection-wise, watch Prometheus for anomalous label cardinality growth on the `wrapMetrics` vectors or sudden memory growth on the TSA process as an early indicator this is being actively probed.

Is CVE-2026-49835 actively exploited?

No confirmed active exploitation of CVE-2026-49835 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-49835?

1) Upgrade to `github.com/sigstore/timestamp-authority/v2` v2.0.7 or later, which restricts Prometheus metric labels to an allowlist of known paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and methods (GET, POST, HEAD, OPTIONS), normalizing everything else to `"unrecognized"`. 2) If immediate patching isn't feasible, block or drop requests with invalid paths/methods at a reverse proxy or load balancer in front of the TSA service. 3) Apply rate limiting on the public interface to cap the rate of unique requests an attacker can generate. 4) Monitor Prometheus/Grafana for unbounded growth in time-series cardinality on the affected metric vectors and set alerting on TSA process memory usage as a leading indicator of an active attempt.

What systems are affected by CVE-2026-49835?

This vulnerability affects the following AI/ML architecture patterns: CI/CD supply-chain signing infrastructure, model/artifact provenance and attestation pipelines, MLOps build pipelines relying on trusted timestamping.

What is the CVSS score for CVE-2026-49835?

CVE-2026-49835 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

CI/CD supply-chain signing infrastructuremodel/artifact provenance and attestation pipelinesMLOps build pipelines relying on trusted timestamping

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

### Impact An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server. This vulnerability exists because the global `wrapMetrics` middleware records the raw HTTP request path (`r.URL.Path`) and raw HTTP request method (`r.Method`) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g., `/api/v1/timestamp/<uuid>`) or random HTTP methods to exhaust system memory. ### Patches This issue has been patched by limiting the metric label values to a strict allowlist of expected paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and expected HTTP methods (`GET`, `POST`, `HEAD`, `OPTIONS`). Unrecognized paths or methods are normalized to a static string (`"unrecognized"`). Users should update to version `v2.0.7` or later. ### Workarounds 1. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the timestamp authority server. 2. Configure rate-limiting on the public interface to prevent remote attackers from issuing millions of unique requests in a short duration.

Exploitation Scenario

An unauthenticated attacker scripts a loop that sends thousands of HTTP requests per minute to the public timestamp authority endpoint, each with a unique path such as `/api/v1/timestamp/<random-uuid>` or a nonstandard HTTP method. Because the `wrapMetrics` middleware runs before routing and unconditionally records the raw path and method as Prometheus labels, each unique combination creates a new permanent time-series entry in the metrics vectors, even though the request itself returns a 404. Left running, this steadily grows the server's memory footprint until the process is OOM-killed or the host becomes unresponsive, denying timestamp issuance to legitimate clients — for example, CI/CD pipelines waiting on a signed timestamp to complete an artifact or model-provenance attestation.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.