CVE-2026-50285
Summary
The HPKE V2 URL decode path in pkg/hpke/url.go decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow (Pomerium Zero / hosted authenticate), the proxy's /.pomerium/callback endpoint is reachable without credentials and processes attacker-crafted HPKE-encrypted payloads before the sender's identity is validated. Because Pomerium's HPKE receiver public key is publicly served, an attacker can encrypt a decompression bomb, deliver it to the callback endpoint, and cause unbounded memory allocation — crashing or degrading the proxy process.
Severity
High (CVSS 3.1: 7.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack Vector: Network — the /.pomerium/callback route on the proxy service is externally reachable.
- Attack Complexity: Low — the receiver public key is publicly available at /.well-known/pomerium/hpke-public-key; no special conditions apply.
- Privileges Required: None — the callback endpoint is intentionally pre-authentication (it is the OAuth landing page).
- User Interaction: None
- Scope: Unchanged — the DoS is confined to the Pomerium proxy process itself.
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High — repeated attacks can exhaust process memory and crash the proxy.
Affected Component
- pkg/hpke/url.go — decodeQueryStringV2 (line 171)
- internal/authenticateflow/stateless.go — Callback (line 385–393)
- proxy/handlers.go — Callback (line 105–107), route registered at line 53–54
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-1284: Improper Validation of Specified Quantity in Input
Description
Unbounded zstd Decompression in decodeQueryStringV2
pkg/hpke/url.go defines two decoders. The V1 path is plaintext. The V2 path zstd-compresses the query string before encryption. Decoding reverses this with no output size cap (url.go:166–176):
var zstdDecoder, _ = zstd.NewReader(nil,
zstd.WithDecoderLowmem(true),
)
func de
⚡ Watch CVE-2026-50285
Get an email if CVE-2026-50285 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-50285)