Linuxfoundation Sigstore Timestamp Authority vulnerabilities

3 CVEs affecting Linuxfoundation Sigstore Timestamp Authority, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49835, published 2026-07-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-49835, published 2026-07-17. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method…
CVE-2025-66564, published 2025-12-04. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID…
CVE-2026-39984, published 2026-04-15. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.…