Skip to content
OpenAdvisories

Package · Go

github.com/pomerium/pomerium

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-50285

    Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

    Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless…

    pomerium pomerium github.com/pomerium/pomerium Go
  • High 8.6
    CVE-2021-39206

    Incorrect Authorization with specially crafted requests

    Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With special…

    pomerium pomerium github.com/pomerium/pomerium Go
  • High 7.5
    CVE-2021-39204

    Excessive CPU usage in Pomerium

    Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can resu…

    pomerium pomerium github.com/pomerium/pomerium Go
  • High 8.6
    CVE-2021-39162

    Incorrect handling of H2 GOAWAY + SETTINGS frames

    Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. …

    pomerium pomerium github.com/pomerium/pomerium Go