157 matches found
pomerium
Pomerium is an identity and context-aware reverse proxy. Pomerium builds secure, clientless connections to internal web apps and other services without a corporate VPN. Pomerium is: Easier with clientless access. Faster by being tunnel-free and deployed where your apps and services are. Safer...
CVE-2026-50285
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...
CVE-2026-50285
Pomerium (identity and context-aware access proxy) versions prior to 0.32.8 are vulnerable to a pre-auth denial of service in the stateless authentication flow. The decodeQueryStringV2 function in pkg/hpke/url.go performs zstd decompression without an output-memory limit before sender identity is...
CVE-2026-50285 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...
EUVD-2026-82410
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...
CVE-2026-50285 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...
CVE-2026-50285 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...
CVE-2026-50285: Improper Validation of Specified Quantity in Input
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...
pomerium v0.33.3
Pomerium is an identity and context-aware reverse proxy. Pomerium builds secure, clientless connections to internal web apps and other services without a corporate VPN. Pomerium is: Easier with clientless access. Faster by being tunnel-free and deployed where your apps and services are. Safer...
Pomerium Detect
A Pomerium SSO Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Pomerium SSO Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pomerium Detect', 'description': 'A Pomerium SSO Pane...
CVE-2026-50285
creationtimestamp| type| source ---|---|--- 2026-07-16 00:35:10+00:00| published-proof-of-concept| https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77...
GHSA-GGW3-5987-RX77 Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Summary The HPKE V2 URL decode path in pkg/hpke/url.go decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow Pomerium Zero / hosted authenticate, the proxy's /.pomerium/callback endpoint is reachable without credentials...
PT-2026-60365
Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.32.8 Description Pomerium is an identity and context-aware access proxy. In hosted or stateless authentication deployments, the /.pomerium/callback endpoint is reachable without credentials and processes...
EUVD-2021-2361
Malware in sbrugna...
EUVD-2021-1066
Malware in sbrugna...
EUVD-2021-0913
Malware in sbrugna...
EUVD-2021-2038
Malware in sbrugna...
EUVD-2021-1989
Malware in sbrugna...