pomerium has 4 CVEs on record between 2021 and 2026. 1 was published in the last 90 days. The median CVSS is 6.2 (medium). Most affected products: github.com/pomerium/pomerium (3), pomerium (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Weakness classes
Products
- github.com/pomerium/pomerium 3
- pomerium 1
Worst active — by depth score
CVE-2026-50285High· 7.5Pomerium is an identity and context-aware access proxy53CVE-2021-29651Medium· 6.3JWT leak via Open Redirect in Programmatic access35CVE-2021-29652Medium· 6.1pomerium_signature is not verified in middleware in github.com/pomerium/pomerium34CVE-2021-41230Medium· 5.3OIDC claims not updated from Identity Provider in Pomerium29
pomerium vulnerabilities
CVEs affecting pomerium, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-50285High· 7.5PoCPomerium is an identity and context-aware access proxy
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V…
CVE-2021-41230Medium· 5.3OIDC claims not updated from Identity Provider in Pomerium
OIDC claims not updated from Identity Provider in Pomerium
CVE-2021-29652Medium· 6.1pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
CVE-2021-29651Medium· 6.3JWT leak via Open Redirect in Programmatic access
JWT leak via Open Redirect in Programmatic access