Pomerium vulnerabilities
We track 3 vulnerabilities in Pomerium products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Pomerium vulnerabilities
- 7.5 High severity
pomerium: Allocation of Resources Without Limits or Throttling
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.
- 9.8 Critical severity
pomerium: Improper Authorization
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
- 9.1 Critical severity
pomerium: Exposure of Sensitive Information to an Unauthorized Actor
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited