CVE-2026-50285: Pomerium uncontrolled resource consumption in HPKE callback decompression

CVE-2026-50285 · Severity: high · CVSS 7.5 · Published 2026-09-17

Pomerium, an identity-aware proxy, is vulnerable to a denial-of-service attack that can crash the service. An unauthenticated attacker can send a specially crafted, highly compressed data packet to a specific public endpoint, causing the server to exhaust its memory while trying to decompress it. This can lead to service outages, preventing legitimate users from accessing protected applications.

Technologies: github.com/pomerium/pomerium (Go). Vendors: Go.

Quick answers

Is CVE-2026-50285 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50285 being exploited in the wild.
How severe is CVE-2026-50285?
High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?
github.com/pomerium/pomerium (Go) >= 0.32.6, < 0.32.8, SEMVER:introduced=0.32.6,fixed=0.32.8; Pomerium >= 0.32.6, < 0.32.8.
Is there a fix for CVE-2026-50285?
Yes. github.com/pomerium/pomerium (Go): upgrade to 0.32.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50285 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50285?
Check whether you run github.com/pomerium/pomerium (Go) or Pomerium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/pomerium/pomerium (Go): upgrade to 0.32.8 or later
    go get github.com/pomerium/pomerium@v0.32.8

Technical details

A resource exhaustion vulnerability (CWE-400) exists in Pomerium's HPKE V2 URL decoding path within `pkg/hpke/url.go`. The `decodeQueryStringV2` function uses `zstd.DecodeAll` on attacker-controlled data without an output size limit. In stateless authentication deployments (Pomerium Zero), the `/.pomerium/callback` endpoint is reachable without authentication and processes these payloads before validating the sender's identity. By utilizing the publicly available HPKE receiver public key, a remote, unauthenticated attacker can deliver a zstd decompression bomb that causes unbounded memory allocation, leading to a process crash. This issue is fixed in version 0.32.8.

Affected products

  • Pomerium Pomerium >= 0.32.6, < 0.32.8

Identifiers

  • CVE-2026-50285
  • GHSA-ggw3-5987-rx77

Timeline

  • 2026-06-04: advisory: GitHub Advisory published
  • 2026-07-15: disclosed: CVE-2026-50285 published
  • patched: Fixed in version 0.32.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.