pomerium

Products

Exploited and recent CVEs

• CVE-2026-50285 High 7.5 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback 0.7%
• CVE-2024-47616 Medium 6.8 Pomerium's service account access token may grant unintended access to databroker API 0.6%
• CVE-2024-39315 Medium 5.7 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response 0.4%
• CVE-2023-33189 Critical 10.0 Incorrect Authorization with specially crafted requests 0.9%
• CVE-2022-24797 Medium 6.5 Exposure of Sensitive Information in Pomerium 1.4%
• CVE-2021-41230 Medium 5.3 OIDC claims not updated from Identity Provider in Pomerium 0.9%
• CVE-2021-39206 High 8.6 Incorrect Authorization with specially crafted requests 1.5%
• CVE-2021-39204 High 7.5 Excessive CPU usage in Pomerium 1.7%
• CVE-2021-39162 High 8.6 Incorrect handling of H2 GOAWAY + SETTINGS frames 1.6%