Skip to content

Commit 9b12a24

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9c54-x2g4-v92j GHSA-p42q-9prx-q5wq
1 parent 7885ee0 commit 9b12a24

2 files changed

Lines changed: 146 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/06/GHSA-9c54-x2g4-v92j/GHSA-9c54-x2g4-v92j.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9c54-x2g4-v92j",
4+
"modified": "2026-06-30T18:40:39Z",
5+
"published": "2026-06-30T18:40:39Z",
6+
"aliases": [
7+
"CVE-2026-49835"
8+
],
9+
"summary": "Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality",
10+
"details": "### Impact\n\nAn unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server.\n\nThis vulnerability exists because the global `wrapMetrics` middleware records the raw HTTP request path (`r.URL.Path`) and raw HTTP request method (`r.Method`) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g., `/api/v1/timestamp/<uuid>`) or random HTTP methods to exhaust system memory.\n\n### Patches\n\nThis issue has been patched by limiting the metric label values to a strict allowlist of expected paths (`/ping`, `/api/v1/timestamp`, `/api/v1/timestamp/certchain`) and expected HTTP methods (`GET`, `POST`, `HEAD`, `OPTIONS`). Unrecognized paths or methods are normalized to a static string (`\"unrecognized\"`).\n\nUsers should update to version `v2.0.7` or later.\n\n### Workarounds\n\n1. Block or drop incoming requests with invalid HTTP methods or unknown request paths at a reverse proxy or load balancer before they reach the timestamp authority server.\n2. Configure rate-limiting on the public interface to prevent remote attackers from issuing millions of unique requests in a short duration.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/sigstore/timestamp-authority/v2"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.1.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.0.6"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Go",
43+
"name": "github.com/sigstore/timestamp-authority"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"last_affected": "1.2.9"
54+
}
55+
]
56+
}
57+
]
58+
}
59+
],
60+
"references": [
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"
64+
},
65+
{
66+
"type": "PACKAGE",
67+
"url": "https://github.com/sigstore/timestamp-authority"
68+
}
69+
],
70+
"database_specific": {
71+
"cwe_ids": [
72+
"CWE-770"
73+
],
74+
"severity": "MODERATE",
75+
"github_reviewed": true,
76+
"github_reviewed_at": "2026-06-30T18:40:39Z",
77+
"nvd_published_at": null
78+
}
79+
}

‎advisories/github-reviewed/2026/06/GHSA-p42q-9prx-q5wq/GHSA-p42q-9prx-q5wq.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p42q-9prx-q5wq",
4+
"modified": "2026-06-30T18:41:30Z",
5+
"published": "2026-06-30T18:41:30Z",
6+
"aliases": [
7+
"CVE-2026-48805"
8+
],
9+
"summary": "Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`",
10+
"details": "### Description\n\nThe 3.26.0 source-policy hardening changed the signature of `CoreExtension::checkArrow()` to take a boolean `$isSandboxed` instead of an `Environment`, and added the same `$isSandboxed` argument to `CoreExtension::arraySome()` and `CoreExtension::arrayEvery()`. Compiled templates were updated to pass the per-source sandbox state computed at the call site.\n\nThe deprecated internal wrappers exposed in `src/Resources/core.php` for legacy third-party code (`twig_check_arrow_in_sandbox()`, `twig_array_some()`, `twig_array_every()`) were not updated:\n\n- `twig_array_some()` and `twig_array_every()` call `CoreExtension::arraySome()` / `arrayEvery()` without forwarding the sandbox state. The underlying methods default `$isSandboxed` to `false`, so the callable-must-be-a-`Closure` restriction is silently bypassed in sandbox mode and a string callable such as `'strcmp'` is accepted.\n- `twig_check_arrow_in_sandbox()` passes the `Environment` object where `CoreExtension::checkArrow()` now expects a `bool`, which throws a `TypeError` on PHP 8+.\n\nCompiled Twig templates are not affected: they call `CoreExtension::*` directly with the correct arguments. Applications are only impacted if they still call the deprecated `twig_*` helpers on top of a sandboxed `Environment`.\n\n### Resolution\n\nThe three wrappers now resolve the current sandbox state via `twig_resolve_is_sandboxed()` (the same helper compiled templates use), and forward it to the corresponding `CoreExtension::*` method. `twig_check_arrow_in_sandbox()` no longer triggers a `TypeError`, and `twig_array_some()` / `twig_array_every()` now enforce the same sandbox restriction as compiled templates.\n\n### Credits\n\nWe would like to thank El Kharoubi Iosif for reporting the issue and Fabien Potencier for providing the fix.",
11+
"severity": [],
12+
"affected": [
13+
{
14+
"package": {
15+
"ecosystem": "Packagist",
16+
"name": "twig/twig"
17+
},
18+
"ranges": [
19+
{
20+
"type": "ECOSYSTEM",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "3.27.0"
27+
}
28+
]
29+
}
30+
],
31+
"database_specific": {
32+
"last_known_affected_version_range": "<= 3.26.0"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/twigphp/Twig/security/advisories/GHSA-p42q-9prx-q5wq"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48805.yaml"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/twigphp/Twig"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/twigphp/Twig/releases/tag/v3.27.0"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://symfony.com/blog/cve-2026-48805-sandbox-state-regression-in-deprecated-internal-wrappers-in-src-resources-core-php"
56+
}
57+
],
58+
"database_specific": {
59+
"cwe_ids": [
60+
"CWE-693"
61+
],
62+
"severity": "LOW",
63+
"github_reviewed": true,
64+
"github_reviewed_at": "2026-06-30T18:41:30Z",
65+
"nvd_published_at": null
66+
}
67+
}

0 commit comments

Comments
 (0)