pomerium

Records11All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

pomerium records in CISA KEV

No pomerium vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pomerium 9 records MEDIUM

Records

11 records

TI-2026-37028 CVE-2026-50285 · GHSA-ggw3-5987-rx77

Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

HIGH 72

Pomerium is an identity and context-aware access proxy.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00741 Published 2026-09-17 Fixed in 0.32.8 CWE-1284

TI-2023-16366 CVE-2023-33189 · GHSA-pvrc-wvj2-f59p

Incorrect Authorization with specially crafted requests

MEDIUM 51

Pomerium is an identity and context-aware access proxy.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00921 Published 2023-05-30 Fixed in 0.22.2, 0.21.4 +4 CWE-285

TI-2022-08610 CVE-2022-24797 · GHSA-q98f-2x4p-prjr

Exposure of Sensitive Information in Pomerium

MEDIUM 48

Pomerium is an identity-aware access proxy.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01378 Published 2022-03-31 Fixed in v0.17.1, 0.17.1 CWE-200

TI-2021-16548 CVE-2021-39162 · GHSA-gjcg-vrxg-xmgv

Incorrect handling of H2 GOAWAY + SETTINGS frames

MEDIUM 41

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01638 Published 2021-09-09 Fixed in 0.15.1 CWE-754

TI-2021-18069 CVE-2021-41230 · GHSA-j6wp-3859-vxfg

OIDC claims not updated from Identity Provider in Pomerium

MEDIUM 40

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0086 Published 2021-11-05 Fixed in 0.15.6 CWE-863

TI-2021-16591 CVE-2021-39206 · GHSA-cfc2-wjcm-c8fm

Incorrect Authorization with specially crafted requests

MEDIUM 40

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01457 Published 2021-09-09 Fixed in 0.14.8, 0.15.1 CWE-863

TI-2021-16589 CVE-2021-39204 · GHSA-5wjf-62hw-q78r

Excessive CPU usage in Pomerium

LOW 36

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01662 Published 2021-09-09 Fixed in 0.14.8, 0.15.1 CWE-834

TI-2024-31896 CVE-2024-47616 · GHSA-r7rh-jww5-5fjr

Pomerium's service account access token may grant unintended access to databroker API

LOW 31

Pomerium is an identity and context-aware access proxy.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00577 Published 2024-10-02 Fixed in 0.27.1 CWE-863

TI-2024-26271 CVE-2024-39315 · GHSA-rrqr-7w59-637v

Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

LOW 29

Pomerium is an identity and context-aware access proxy.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00416 Published 2024-07-02 Fixed in 0.26.1 CWE-201

TI-2021-10352 CVE-2021-29652 · GHSA-fv82-r8qv-ch4v

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process

LOW 28

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00658 Published 2021-04-02 Fixed in 0.13.4 CWE-601

TI-2021-10351 CVE-2021-29651 · GHSA-35vc-w93w-75c2

Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).

LOW 28

Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00658 Published 2021-04-02 Fixed in 0.13.4 CWE-601

Open these records in search →

Critical	2
High	5
Medium	4
Low	0
No CVSS	0