Product by Go
Github.com/pomerium/pomerium
11 known vulnerabilities in Github.com/pomerium/pomerium (Go), 0 of them actively exploited (CISA KEV).
Key figures
11
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-39162 | Incorrect handling of H2 GOAWAY + SETTINGS frames | 8.6 | |
| High | CVE-2026-50285 | Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback | 7.5 | |
| High | CVE-2021-39206 | Incorrect Authorization with specially crafted requests | 8.6 | |
| High | CVE-2021-39204 | Excessive CPU usage in Pomerium | 7.5 | |
| Critical | CVE-2023-33189 | Incorrect Authorization with specially crafted requests | 10.0 | |
| Critical | CVE-2022-24797 | Exposure of Sensitive Information in Pomerium | 6.5 | |
| Medium | CVE-2024-47616 | Pomerium's service account access token may grant unintended access to databroker API | 6.8 | |
| High | CVE-2021-41230 | OIDC claims not updated from Identity Provider in Pomerium | 5.3 | |
| Medium | CVE-2021-29652 | Pomerium: Open Redirect | 6.1 | |
| Medium | CVE-2021-29651 | Pomerium: Open Redirect | 6.1 | |
| Medium | CVE-2024-39315 | Pomerium exposed OAuth2 access and ID tokens in user info endpoint response | 5.7 |