CVE-2026-50285

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pomerium/pomerium/commit/593eb81c7e5bdbe6071a30d330f374967869577f
https://github.com/pomerium/pomerium/releases/tag/v0.32.8
https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77
https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77

Configurations

No configuration.

History

17 Sep 2026, 21:17

Type	Values Removed	Values Added
References	~~() https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77 -~~	() https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77 -

17 Sep 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 20:16

Updated : 2026-09-24 21:25

NVD link : CVE-2026-50285

Mitre link : CVE-2026-50285

CVE.ORG link : CVE-2026-50285

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2026-50285", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50285", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T20:19:36.446302Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pomerium", "product": "pomerium", "versions": [{"status": "affected", "version": "< 0.32.8"}]}]}], "published": "2026-09-17T20:16:50.290", "references": [{"url": "https://github.com/pomerium/pomerium/commit/593eb81c7e5bdbe6071a30d330f374967869577f", "source": "security-advisories@github.com"}, {"url": "https://github.com/pomerium/pomerium/releases/tag/v0.32.8", "source": "security-advisories@github.com"}, {"url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77", "source": "security-advisories@github.com"}, {"url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8."}], "lastModified": "2026-09-24T21:25:27.050", "sourceIdentifier": "security-advisories@github.com"}