CVE-2026-50285

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50285
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50285.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50285
Aliases
Published
2026-09-17T19:49:20Z
Modified
2026-09-19T03:46:24Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Details

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1284",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50285.json"
}
References

Affected packages

Git / github.com/pomerium/pomerium

Affected ranges

Type
GIT
Repo
https://github.com/pomerium/pomerium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
593eb81c7e5bdbe6071a30d330f374967869577f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.32.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.10.0
v0.10.0-rc1
v0.10.0-rc2
v0.10.0-rc3
v0.11.0
v0.11.0-rc1
v0.11.0-rc2
v0.12.0
v0.14.0
v0.14.0-rc2
v0.15.0
v0.15.6
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.23.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.3.0
v0.32.0
v0.32.1
v0.32.2
v0.32.3
v0.32.4
v0.32.5
v0.32.6
v0.32.7
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50285.json"