Pomerium vulnerabilities (CVEs)

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

• CVE-2021-39204 ↗EPSS 1.7%LEV ≥65%Probably exploited

  Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive comple…

• CVE-2021-39162 ↗EPSS 1.6%LEV ≥64%Probably exploited

  Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are rece…

• CVE-2021-39206 ↗EPSS 1.5%LEV ≥60%Probably exploited

  Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and…

• CVE-2022-24797 ↗EPSS 1.4%LEV ≥54%Probably exploited

  Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to …

• CVE-2021-41230 ↗EPSS 0.9%LEV ≥41%Elevated risk

  Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in polic…

• CVE-2023-33189 is now estimated at a 31% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2021-39162 is now estimated at a 63% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2021-41230 is now estimated at a 40% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2021-39204 is now estimated at a 64% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2021-39206 is now estimated at a 59% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

• CVE-2026-50285 ↗HIGH 7.52026

  Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit w…

• CVE-2024-47616 ↗MEDIUM 6.82024

  Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API ar…

• ↗

• CVEs come from the US National Vulnerability Database (NVD) and are matched to Pomerium by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-09-24.
• Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
• Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.