Pomerium up to 0.32.7 Stateless Callback pkg/hpke/url.go decodeQueryStringV2 resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in Pomerium up to 0.32.7. Affected is the function decodeQueryStringV2 of the file pkg/hpke/url.go of the component Stateless Callback Handler. Executing a manipulation can lead to resource consumption. This vulnerability is tracked as CVE-2026-50285. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Pomerium up to 0.32.7. It has been declared as problematic. This vulnerability affects the function decodeQueryStringV2 of the file pkg/hpke/url.go of the component Stateless Callback Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-50285 since 06/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 0.32.8 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Pomerium

Version

• 0.32.0
• 0.32.1
• 0.32.2
• 0.32.3
• 0.32.4
• 0.32.5
• 0.32.6
• 0.32.7

Website

• Product: https://github.com/pomerium/pomerium/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion