Multiple security issues in Pomerium's embedded envoy
Summary
GHSA-j34v-3552-5r7j: Multiple security issues in Pomerium's embedded envoy. Affects github.com/pomerium/pomerium versions < 0.16.4. Fixed in 0.16.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is a package based on Envoy, which is a high-performance proxy developed in Go. Envoy has recently issued multiple CVEs that impact stability and security. Pomerium, although not vulnerable to all of these issues, is recommended to be upgraded to version 0.16.4 to minimize risk. The vulnerabilities in Envoy can lead to potential denial of service or crashes, unauthorized access to resources, and trusting of upstream certificates that should not be trusted.
Vulnerability Detail
The vulnerabilities in Envoy that affect Pomerium include:
- CVE-2021-43824: Potential null pointer dereference when using JWT filter safe_regex match.
- CVE-2021-43825: Use-after-free when response filters increase response data, and increased data exceeds downstream buffer limits.
- CVE-2021-43826: Use-after-free when tunneling TCP over HTTP, if downstream disconnects during upstream connection establishment.
- CVE-2022-21654: Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed.
- CVE-2022-21655: Incorrect handling of internal redirects to routes with a direct response entry.
- CVE-2022-21657: X.509 Extended Key Usage and Trust Purposes bypass.
These vulnerabilities can have various impacts, including possible denial of service or crashes, unauthorized access to resources, and trusting of untrusted certificates.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.16.4
This is the first release that contains the fix.
go get github.com/pomerium/pomerium@v0.16.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading to Pomerium version 0.16.4 is highly recommended to address the identified vulnerabilities in Envoy. This upgrade will ensure that your Pomerium installation is secure and protected against possible denial of service, unauthorized access, and certificate trust issues. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
Pomerium is a package based on Envoy, a high-performance proxy developed in Go. It provides secure access to internal applications and services.
The impacts of these vulnerabilities include possible denial of service or crashes, unauthorized access to resources, and trusting of untrusted certificates.
To fix these vulnerabilities, it is recommended to upgrade to Pomerium version 0.16.4. This version includes patches for the identified vulnerabilities in Envoy.
No, not all versions of Pomerium are affected by these vulnerabilities. However, it is still recommended to upgrade to version 0.16.4 to ensure security.
You can find more information about these vulnerabilities in the Envoy Security Announcement and the respective CVEs linked in the references section of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
