Attack Chain

1. An unauthenticated attacker identifies a Pomerium proxy deployment utilizing the stateless authentication flow.
2. The attacker retrieves the Pomerium proxy's public HPKE receiver key by sending an HTTP GET request to the publicly accessible /.well-known/pomerium/hpke-public-key endpoint.
3. The attacker generates their own ephemeral HPKE sender key pair to encrypt the malicious payload.
4. The attacker crafts a zstd "decompression bomb" payload, designed to be small when compressed but expand into a very large amount of data upon decompression (e.g., 19 KB compressed to 128 MiB uncompressed).
5. The attacker uses their generated sender private key and Pomerium's retrieved receiver public key to encrypt (seal) the decompression bomb payload.
6. The attacker sends an HTTP GET request to the pre-authenticated /.pomerium/callback endpoint on the Pomerium proxy, including the encrypted decompression bomb as a query parameter (e.g., q).
7. The Pomerium proxy receives the request and, before validating the sender's identity, proceeds to decrypt and decompress the payload using hpke.DecryptURLValues and decodeQueryStringV2.
8. Due to the lack of an output size limit in decodeQueryStringV2, the decompression of the malicious payload consumes a disproportionate amount of server memory, leading to process degradation, unresponsiveness, or a crash, resulting in a denial of service.

Impact

This vulnerability enables a pre-authentication denial of service (DoS) against any Pomerium proxy using the hosted/stateless authenticate flow (Pomerium Zero or authenticate.pomerium.app). An attacker with network reachability to the proxy's HTTPS port can allocate hundreds of megabytes of server memory per HTTP request by sending a small (approximately 20 - 40 KB) malicious payload. Sustained attacks with concurrent requests can quickly exhaust available memory, leading to the crash of the proxy process and effectively blocking all user access to every application protected by that Pomerium deployment. No credentials, session cookies, or insider access are required for this attack.

Recommendation

• Upgrade Pomerium to version 0.32.8 or later immediately to address CVE-2026-50285.
• Monitor the memory usage of Pomerium proxy processes for sudden spikes or sustained high consumption, which could indicate a decompression bomb attack.
• If immediate patching is not possible, consider implementing network-level rate limiting or Web Application Firewall (WAF) rules to restrict repeated requests to the /.pomerium/callback endpoint from suspicious IP addresses, referencing the IOCs.