Pomerium vulnerabilities

Products

• Pomerium 11

Newest

• pomerium Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback CVE-2026-50285 Fix available 7.5 HighJuly 15, 2026
• pomerium Pomerium's service account access token may grant unintended access to databroker API CVE-2024-47616 Fix available 6.8 MediumOctober 2, 2024
• pomerium Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVE-2024-39315 Fix available 5.7 MediumJuly 2, 2024
• pomerium Incorrect Authorization with specially crafted requests CVE-2023-33189 Fix available 10.0 CriticalMay 26, 2023
• pomerium Exposure of Sensitive Information in Pomerium CVE-2022-24797 Fix available 6.5 MediumMarch 31, 2022
• pomerium OIDC claims not updated from Identity Provider in Pomerium CVE-2021-41230 Fix available 5.3 MediumNovember 5, 2021
• envoyproxy envoy, pomerium +1 more Incorrect Authorization with specially crafted requests CVE-2021-39206 Fix available 8.6 HighSeptember 9, 2021
• envoyproxy envoy, pomerium +1 more Excessive CPU usage in Pomerium CVE-2021-39204 Fix available 7.5 HighSeptember 9, 2021
• envoyproxy envoy, pomerium +1 more Incorrect handling of H2 GOAWAY + SETTINGS frames CVE-2021-39162 Fix available 8.6 HighSeptember 9, 2021
• pomerium pomerium_signature is not verified in middleware in github.com/pomerium/pomerium CVE-2021-29652 Fix available 6.1 MediumApril 2, 2021
• pomerium JWT leak via Open Redirect in Programmatic access CVE-2021-29651 Fix available 6.1 MediumApril 2, 2021