pomerium vulnerabilities

CVEs whose affected-version data names the pomerium package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-50285High· 7.5PoC

5d ago

Pomerium is an identity and context-aware access proxy

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V…

▾ Midnightpomerium · pomeriumEPSS 0.65%via NVD