CVE-2026-50285: Pomerium Memory Exhaustion via Unbounded zstd Decompression
Summary
CVE-2026-50285: Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback. Affects github.com/pomerium/pomerium versions >= 0.32.6, < 0.32.8. Fixed in 0.32.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is an open-source identity-aware access proxy that enables secure access to applications by managing authentication and authorization. It supports various authentication flows, including stateless authentication, which allows users to authenticate without maintaining session state on the server. This vulnerability arises in the HPKE (Hybrid Public Key Encryption) implementation, specifically in the URL decoding process, where unbounded decompression of attacker-controlled data can lead to memory exhaustion.
Vulnerability Detail
The vulnerability exists in the HPKE V2 URL decode path within the pkg/hpke/url.go file, where zstd-compressed data is decompressed without any size limit. This allows an attacker to craft a decompression bomb that, when sent to the /callback endpoint, can cause unbounded memory allocation, potentially crashing or degrading the proxy process. The callback endpoint is accessible without authentication, making it easy for attackers to exploit this vulnerability. The lack of input size validation in the decompression function is the root cause, leading to a denial of service (DoS) condition.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.32.8
This is the first release that contains the fix.
go get github.com/pomerium/pomerium@v0.32.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a rate limit on incoming requests to the /callback endpoint to mitigate the impact of potential attacks. However, this does not fully resolve the underlying vulnerability. Here is a sample code snippet to limit the number of requests:
http.HandleFunc("/.pomerium/callback", rateLimit(callbackHandler))
func rateLimit(next http.HandlerFunc) http.HandlerFunc {
limiter := time.NewTicker(1 * time.Second)
defer limiter.Stop()
return func(w http.ResponseWriter, r *http.Request) {
<-limiter.C
next(w, r)
}
}
Conclusion
CVE-2026-50285 is a critical vulnerability in Pomerium that allows for memory exhaustion through unbounded decompression of attacker-controlled data. It is essential to update to the latest version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
CVE-2026-50285 is a vulnerability in Pomerium that allows for memory exhaustion via unbounded zstd decompression in the HPKE callback.
This vulnerability can lead to denial of service (DoS) by allowing attackers to send crafted payloads that exhaust memory resources, potentially crashing the proxy.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
To protect your application, update to the patched version of Pomerium (0.32.8 or later) and consider implementing additional input validation and rate limiting.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
