{"action":"Upgrade github.com/pomerium/pomerium to 0.14.8 or later.","affected":[{"fixed":"0.14.8","introduced":"0.11.0"},{"fixed":"0.15.1","introduced":"0.15.0"}],"component":"github.com/pomerium/pomerium","cve_ids":["CVE-2021-39206"],"ecosystem":"Go","epss":0.01457,"exploited":false,"fixed_versions":["0.14.8","0.15.1"],"ghsa_id":"GHSA-cfc2-wjcm-c8fm","id":"tcs_01M5KF77MDS46G67MM7MW6HE5D","modified_at":"2026-02-04T02:38:41.602246Z","published_at":"2021-09-10T17:54:25Z","references":["https://osv.dev/vulnerability/GHSA-cfc2-wjcm-c8fm","https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h","https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9","https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fm","https://nvd.nist.gov/vuln/detail/CVE-2021-39206","https://github.com/pomerium/pomerium","https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-cfc2-wjcm-c8fm","url":"https://osv.dev/vulnerability/GHSA-cfc2-wjcm-c8fm"}],"summary":"Incorrect Authorization with specially crafted requests"}