Pomerium 0.15.0
Approved changes feed: RSS · Atom
cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:*part: a version: 0.15.0 update: *
| Vendor | Pomerium (ae0d6fa4-9d7c-52c9-ae68-f53b8d741798) |
|---|---|
| Product | Pomerium (ecb31a58-b947-599a-8cef-697f2999ebc3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/pomerium/pomerium |
purl2cpe | 2026-06-01 10:14:51.561926 |
pkg:github/pomerium/pomerium |
purl2cpe | 2026-06-01 10:14:51.561927 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-39206 |
vulnerable | 2026-06-08 05:33:49.196754 |
Incorrect Authorization with specially crafted requests
HIGH (8.6)
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.
Published: 2021-09-09T22:10:15.000Z
Updated: 2024-08-04T01:58:18.262Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39204 |
vulnerable | 2026-06-08 05:33:49.187483 |
Excessive CPU usage in Pomerium
HIGH (7.5)
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
Published: 2021-09-09T22:10:09.000Z
Updated: 2024-08-04T01:58:18.254Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39162 |
vulnerable | 2026-06-08 05:33:49.071510 |
Incorrect handling of H2 GOAWAY + SETTINGS frames
HIGH (8.6)
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
Published: 2021-09-09T22:05:11.000Z
Updated: 2024-08-04T01:58:18.235Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.