Vulnerabilities

TI-2026-37028 CVE-2026-50285 · GHSA-ggw3-5987-rx77

Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

HIGH 72

Pomerium is an identity and context-aware access proxy.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00741 Published 2026-09-17 Fixed in 0.32.8 CWE-1284

TI-2024-31896 CVE-2024-47616 · GHSA-r7rh-jww5-5fjr

Pomerium's service account access token may grant unintended access to databroker API

LOW 31

Pomerium is an identity and context-aware access proxy.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00577 Published 2024-10-02 Fixed in 0.27.1 CWE-863

TI-2024-26271 CVE-2024-39315 · GHSA-rrqr-7w59-637v

Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

LOW 29

Pomerium is an identity and context-aware access proxy.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00416 Published 2024-07-02 Fixed in 0.26.1 CWE-201

TI-2023-16366 CVE-2023-33189 · GHSA-pvrc-wvj2-f59p

Incorrect Authorization with specially crafted requests

MEDIUM 51

Pomerium is an identity and context-aware access proxy.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00921 Published 2023-05-30 Fixed in 0.22.2, 0.21.4 +4 CWE-285

TI-2022-08610 CVE-2022-24797 · GHSA-q98f-2x4p-prjr

Exposure of Sensitive Information in Pomerium

MEDIUM 48

Pomerium is an identity-aware access proxy.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01378 Published 2022-03-31 Fixed in v0.17.1, 0.17.1 CWE-200

TI-2021-18069 CVE-2021-41230 · GHSA-j6wp-3859-vxfg

OIDC claims not updated from Identity Provider in Pomerium

MEDIUM 40

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0086 Published 2021-11-05 Fixed in 0.15.6 CWE-863

TI-2021-16591 CVE-2021-39206 · GHSA-cfc2-wjcm-c8fm

Incorrect Authorization with specially crafted requests

MEDIUM 40

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01457 Published 2021-09-09 Fixed in 0.14.8, 0.15.1 CWE-863

TI-2021-16589 CVE-2021-39204 · GHSA-5wjf-62hw-q78r

Excessive CPU usage in Pomerium

LOW 36

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01662 Published 2021-09-09 Fixed in 0.14.8, 0.15.1 CWE-834

TI-2021-16548 CVE-2021-39162 · GHSA-gjcg-vrxg-xmgv

Incorrect handling of H2 GOAWAY + SETTINGS frames

MEDIUM 41

Pomerium is an open source identity-aware access proxy.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01638 Published 2021-09-09 Fixed in 0.15.1 CWE-754

TI-2021-10352 CVE-2021-29652 · GHSA-fv82-r8qv-ch4v

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process

LOW 28

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00658 Published 2021-04-02 Fixed in 0.13.4 CWE-601

TI-2021-10351 CVE-2021-29651 · GHSA-35vc-w93w-75c2

Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).

LOW 28

Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00658 Published 2021-04-02 Fixed in 0.13.4 CWE-601

Vulnerabilities

Filters