Snowplow vulnerabilities
We track 4 vulnerabilities in Snowplow products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on April 3, 2025.
Latest Snowplow vulnerabilities
- 7.5 High severity
Stream Collector: Uncontrolled Resource Consumption
This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As
- 7.5 High severity
Snowbridge: Improper Check or Handling of Exceptional Conditions
An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events, causing them to be retried indefinitely. As a result, the performance of forwarding events to GTM SS
- 7.5 High severity
Enrich: Improper Resource Shutdown or Release
An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon receiving this event and trying to validate it, Enrich crashes and attempts to restart indefinitely. As a result, event pro
- 7.5 High severity
Iglu Server: Uncontrolled Resource Consumption
An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pip