VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/pomerium/pomerium: vulnerability history, versions and safety

github.com/pomerium/pomerium is a package in the Go ecosystem. Vulert records 21 vulnerabilities for it across 120 releases, from May 2021 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
21 vulnerabilities recorded C1 H5 M6 U9
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
1 in the last 12 months

Most recent disclosure 15 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/pomerium/pomerium vulnerabilities

Vulert verdict on github.com/pomerium/pomerium v0.33.4 i

Updated on 23 Oct 2026

Action needed: v0.33.4 has 13 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 79/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.33.4 — affected i
  • Vulnerabilities on record 21 over 5 years · 1 in the last year i
  • Latest disclosure 15 Jul 2026 i
  • Highest CVSS 10.0 i
  • With no published fix 0 i
  • Stars 5,046 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/pomerium/pomerium, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022115009-ef202e00903e 22 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261022115009-ef202e00903e 22 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261022024308-a18c519b508b 22 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261022024308-a18c519b508b 22 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261021180520-a4a75b9221fa 21 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261021180520-a4a75b9221fa 21 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261021174653-79865268459a 21 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261021174653-79865268459a 21 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261020002205-f4cce6ac74ec 20 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261020002205-f4cce6ac74ec 20 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261015190000-28d49c750cc7 15 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261015190000-28d49c750cc7 15 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261015171204-44970f6b3976 15 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261015171204-44970f6b3976 15 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261015164333-0a822b57b01a 15 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261015164333-0a822b57b01a 15 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261013232945-35b2a975d745 13 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261013232945-35b2a975d745 13 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261009235336-486a6eb68517 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261009235336-486a6eb68517 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261009183805-64b2530442fe 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261009183805-64b2530442fe 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261009183624-7549424a1b43 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261009155104-946066dcddc6 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261009152929-07875891fece 09 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261008220126-42f06e470824 08 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261008220126-42f06e470824 08 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261008210546-191df7fbd8f2 08 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261008210546-191df7fbd8f2 08 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261008052929-3f08ebcdffd6 08 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261008052929-3f08ebcdffd6 08 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261007164227-617a1efbe991 07 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261007164227-617a1efbe991 07 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261006182150-516d9fd89891 06 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261006182150-516d9fd89891 06 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261005180551-cfdbc90c5bd6 05 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261005180551-cfdbc90c5bd6 05 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261005145911-45f90e5756a4 05 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261005145911-45f90e5756a4 05 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261002194704-395f41d1eee2 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261002194704-395f41d1eee2 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261002193425-5cd94927fee5 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.33.4 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261002183543-fe4244989223 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261002183543-fe4244989223 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261002183436-e88b32a4bafe 02 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261001234607-046c6c391af4 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001234607-046c6c391af4 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261001223859-1aadc7a67171 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001223859-1aadc7a67171 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261001221424-3374e4b6c4d8 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001213833-d7c5472c4f40 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261001210954-fc5ffda097d7 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001210954-fc5ffda097d7 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001192857-e0c8985ea9ec 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001192835-9bcf57bb0a41 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261001192726-e74e25faa281 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20261001192726-e74e25faa281 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20261001192659-926217115210 01 Oct 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260930190004-ad89ddc352c2 30 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260930190004-ad89ddc352c2 30 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260929225234-d13c697a8596 29 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260929225234-d13c697a8596 29 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260929144847-341bc68d609f 29 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260929144753-3daf272a9f47 29 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260925164750-35d2936ae767 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260925164750-35d2936ae767 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260925155209-d8e5f006406d 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260925155209-d8e5f006406d 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260925012118-6b89db3a5e85 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260925012118-6b89db3a5e85 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260925010757-a000b7814936 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260925010757-a000b7814936 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260925000950-4bbf61ec7a00 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260925000950-4bbf61ec7a00 25 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260924221810-5eeb9e070bf4 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260924221810-5eeb9e070bf4 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260924220723-90d0ec07301d 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260924220723-90d0ec07301d 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260924183941-ee4bb7400118 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260924183941-ee4bb7400118 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260924152315-f86d7c00ad98 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260924152315-f86d7c00ad98 24 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260923184431-c761da3e194e 23 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260923184431-c761da3e194e 23 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260923165235-43ecff968e36 23 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260923165235-43ecff968e36 23 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260922185730-17b2343ed3d2 22 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260922181352-6a0461070c4a 22 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260922181352-6a0461070c4a 22 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260921173907-7d01a9f293e9 21 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260921173907-7d01a9f293e9 21 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260918222337-04e0f727dcd1 18 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260918222337-04e0f727dcd1 18 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260918202945-68343f3e90ca 18 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260918180658-d7f612868351 18 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260918180658-d7f612868351 18 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260918002645-1cc0c2bb7d95 18 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260917144030-ee74e190c89c 17 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.32.5-rc.1.0.20260917144030-ee74e190c89c 17 Sep 2026 H3 M3 U7 Apache-2.0 Yes Details →
v0.0.0-20260917003855-da5b1f891f4c 17 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260917003855-da5b1f891f4c 17 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260916233521-7b6993e60c67 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260916233521-7b6993e60c67 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260916223211-3cad7236a920 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260916223211-3cad7236a920 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260916191237-e653c67409d4 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260916191237-e653c67409d4 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260916155631-56ad09e2aa08 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260916155631-56ad09e2aa08 16 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260915183240-e16bca91a200 15 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260915183240-e16bca91a200 15 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260915160442-00368d41f83f 15 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260915160442-00368d41f83f 15 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260915154922-f57567856091 15 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260915154922-f57567856091 15 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260914185819-9fbdb245ff07 14 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260914185819-9fbdb245ff07 14 Sep 2026 H3 M3 U7 — Yes Details →
v0.0.0-20260911201225-1e32fd4c5048 11 Sep 2026 H3 M3 U7 — Yes Details →
v0.32.5-rc.1.0.20260911201225-1e32fd4c5048 11 Sep 2026 H3 M3 U7 — Yes Details →

The newest 120 of 4,085 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 6
  • 2022 3
  • 2023 1
  • 2024 10
  • 2026 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 21 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/pomerium/pomerium

The 5 most severe of 21 vulnerabilities recorded for this package

Search all 21 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-33189: Pomerium Incorrect Authorization Vulnerability 10.0 critical 0.22.2 26 May 2023
CVE-2021-39206: Incorrect Authorization in Pomerium 8.6 high 0.14.8 10 Sep 2021
CVE-2021-39162: Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium 8.6 high 0.15.1 10 Sep 2021
CVE-2021-39204: Excessive CPU usage in github.com/pomerium/pomerium 7.5 high 0.14.8 10 Sep 2021
CVE-2026-50285: Pomerium Memory Exhaustion via Unbounded zstd Decompression 7.5 high 0.32.8 15 Jul 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/pomerium/pomerium

Is github.com/pomerium/pomerium safe to use?

Vulert records 21 vulnerabilities for github.com/pomerium/pomerium in Go: 1 critical, 5 high, 6 medium and 0 low, plus 9 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/pomerium/pomerium's Vulert package health score?

Vulert scores github.com/pomerium/pomerium 79/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/pomerium/pomerium affected?

Yes. v0.33.4, the version you would install today, has 13 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/pomerium/pomerium should I use?

v0.33.4 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/pomerium/pomerium have?

21 vulnerabilities are recorded for github.com/pomerium/pomerium in the Go ecosystem: 1 critical, 5 high, 6 medium and 0 low, plus 9 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/pomerium/pomerium vulnerabilities disclosed?

1 vulnerability was recorded for github.com/pomerium/pomerium in the last 12 months, and the oldest entry in this database dates to 21 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/pomerium/pomerium are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/pomerium/pomerium for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/pomerium/pomerium version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.