We support the last minor release (e.g. Pomerium v0.21.x).
See https://www.pomerium.com/docs/releases.
See https://www.pomerium.com/docs/internals/security#reporting-a-security-bug for how to report a vulnerability.
Security: pomerium/pomerium
Security
SECURITY.md
-
Incorrect Authorization with specially crafted requestsGHSA-pvrc-wvj2-f59p published
May 26, 2023 by desimoneCritical -
Exposure of debug and metrics endpoints in PomeriumGHSA-q98f-2x4p-prjr published
Mar 30, 2022 by travisgrothModerate -
Multiple security issues in Pomerium's embedded envoyGHSA-j34v-3552-5r7j published
Feb 28, 2022 by travisgrothModerate -
OIDC claims not updated from Identity Provider in PomeriumGHSA-j6wp-3859-vxfg published
Nov 5, 2021 by travisgrothModerate -
Incorrect handling of H2 GOAWAY + SETTINGS framesGHSA-gjcg-vrxg-xmgv published
Sep 9, 2021 by travisgrothHigh -
Excessive CPU usageGHSA-5wjf-62hw-q78r published
Sep 9, 2021 by travisgrothHigh -
Incorrect Authorization with specially crafted requestsGHSA-cfc2-wjcm-c8fm published
Sep 9, 2021 by travisgrothHigh -
authenticate: pomerium_signature is not verified in middlewareGHSA-fv82-r8qv-ch4v published
Mar 31, 2021 by travisgrothHigh -
JWT leak via Open Redirect in Programmatic accessGHSA-35vc-w93w-75c2 published
Mar 31, 2021 by travisgrothHigh
Learn more about advisories related to pomerium/pomerium in the GitHub Advisory Database