github.com/sigstore/timestamp-authority vulnerabilities
CVEs whose affected-version data names the github.com/sigstore/timestamp-authority package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-49835Medium· 5.9Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
▾ Sunlitsigstore · github.com/sigstore/timestamp-authority/v2EPSS 0.45%via GHSA
CVE-2025-66564High· 7.5Sigstore Timestamp Authority allocates excessive memory during request parsing
Sigstore Timestamp Authority allocates excessive memory during request parsing
▾ Twilightsigstore · github.com/sigstore/timestamp-authorityEPSS 0.44%via OSV