CVE-2026-50285

Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.32.8

Description Pomerium is an identity and context-aware access proxy. In hosted or stateless authentication deployments, the /.pomerium/callback endpoint is reachable without credentials and processes HPKE-encrypted payloads before the sender's identity is validated. The decodeQueryStringV2 function in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit. An unauthenticated attacker can obtain the receiver public key from /.well-known/pomerium/hpke-public-key, provide a matching sender key, and send a compressed payload (a decompression bomb) to the /.pomerium/callback endpoint. This can result in the allocation of hundreds of megabytes of memory per request, leading to memory exhaustion, process crashes, or performance degradation, effectively blocking access to protected applications. This issue does not affect stateful deployments as they verify an HMAC signature before decryption and decompression.

Recommendations Update to version 0.32.8. As a temporary mitigation, restrict access to the /.pomerium/callback endpoint to trusted sources if possible, or implement a memory limit on the proxy process to prevent total system failure.