We support the last minor release (e.g. Pomerium v0.21.x).
See https://www.pomerium.com/docs/releases.
See https://www.pomerium.com/docs/internals/security#reporting-a-security-bug for how to report a vulnerability.
Security: pomerium/pomerium
Security
SECURITY.md
-
Service account access token may grant unintended access to databroker APIGHSA-r7rh-jww5-5fjr published
Oct 2, 2024 by kenjenkinsModerate -
OAuth2 access and ID tokens exposed in user info endpoint responseGHSA-rrqr-7w59-637v published
Jul 2, 2024 by desimoneModerate -
Incorrect Authorization with specially crafted requestsGHSA-pvrc-wvj2-f59p published
May 26, 2023 by desimoneCritical -
Exposure of debug and metrics endpoints in PomeriumGHSA-q98f-2x4p-prjr published
Mar 30, 2022 by travisgrothModerate -
Multiple security issues in Pomerium's embedded envoyGHSA-j34v-3552-5r7j published
Feb 28, 2022 by travisgrothModerate -
OIDC claims not updated from Identity Provider in PomeriumGHSA-j6wp-3859-vxfg published
Nov 5, 2021 by travisgrothModerate -
Incorrect handling of H2 GOAWAY + SETTINGS framesGHSA-gjcg-vrxg-xmgv published
Sep 9, 2021 by travisgrothHigh -
Excessive CPU usageGHSA-5wjf-62hw-q78r published
Sep 9, 2021 by travisgrothHigh -
Incorrect Authorization with specially crafted requestsGHSA-cfc2-wjcm-c8fm published
Sep 9, 2021 by travisgrothHigh -
authenticate: pomerium_signature is not verified in middlewareGHSA-fv82-r8qv-ch4v published
Mar 31, 2021 by travisgrothHigh
Learn more about advisories related to pomerium/pomerium in the GitHub Advisory Database