Description

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-17T20:16:50.290Z",
  "pubdate": "2026-09-17T20:16:50.290Z",
  "executiveSummary": "An improper resource management vulnerability exists in Pomerium versions prior to 0.32.8, specifically within the stateless authentication flow.\nThe vulnerability involves the lack of memory allocation limits during zstd decompression of attacker-supplied HPKE payloads.\nUnauthenticated remote attackers can trigger this condition by submitting specially crafted requests to the /.pomerium/callback endpoint.\nSuccessful exploitation results in arbitrary memory exhaustion, leading to process crashes or significant service degradation, effectively causing a Denial of Service (DoS) for protected applications.\nThe issue is limited to stateless or hosted deployments; stateful deployments are protected by HMAC signature validation prior to the decompression phase.\nThe risk is high for affected deployments as it does not require authentication or elevated privileges, allowing for low-effort service disruption.",
  "technicalDetails": "The root cause of this vulnerability is the absence of an output-memory limit during zstd decompression within the decodeQueryStringV2 function located in pkg/hpke/url.go. This function is invoked by DecryptURLValues when processing HPKE V2 values destined for the Stateless.Callback handler in internal/authenticateflow/stateless.go.\nIn stateless deployments, the system attempts to decrypt and decompress user-provided data before full validation of the sender's cryptographic identity is completed. An attacker can obtain the necessary public key from /.well-known/pomerium/hpke-public-key and craft a malicious HPKE payload. By sending this payload to /.pomerium/callback, the attacker forces the application to allocate memory for the decompressed data.\nThe attack flow follows these steps: 1) The attacker fetches the public key from the well-known endpoint to construct a validly encrypted, yet malicious, payload. 2) The attacker sends an HTTP request to /.pomerium/callback containing the crafted payload. 3) The Pomerium instance receives the request and enters the decodeQueryStringV2 routine. 4) The zstd decompressor processes the payload, expanding it into a significantly larger size in memory. 5) Because there is no imposed output size limit, the memory allocator satisfies the request, consuming hundreds of megabytes per malicious packet. 6) Repeated requests lead to rapid heap growth, resulting in OOM (Out of Memory) conditions that crash the process or cause severe performance degradation for legitimate requests.\nStateful deployments remain unaffected because they verify the HMAC signature of the request before attempting any decryption or decompression, preventing the processing of arbitrary attacker-controlled data at the vulnerable component. The vulnerability is strictly confined to the logic path in stateless authentication modules where decompression occurs prematurely relative to cryptographically sound identity verification."
}