{"action":"Upgrade github.com/pomerium/pomerium to 0.32.8 or later.","affected":[{"fixed":"0.32.8","introduced":"0.32.6"}],"component":"github.com/pomerium/pomerium","cve_ids":["CVE-2026-50285"],"ecosystem":"Go","epss":0.00741,"exploited":false,"fixed_versions":["0.32.8"],"ghsa_id":"GHSA-ggw3-5987-rx77","id":"tcs_01M5KFAZXWP326SNTZ5T99C5F2","modified_at":"2026-07-15T23:26:43.110013Z","published_at":"2026-07-15T23:08:18Z","references":["https://osv.dev/vulnerability/GHSA-ggw3-5987-rx77","https://github.com/pomerium/pomerium/security/advisories/GHSA-ggw3-5987-rx77","https://github.com/pomerium/pomerium/commit/593eb81c7e5bdbe6071a30d330f374967869577f","https://github.com/pomerium/pomerium","https://github.com/pomerium/pomerium/releases/tag/v0.32.8"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-ggw3-5987-rx77","url":"https://osv.dev/vulnerability/GHSA-ggw3-5987-rx77"}],"summary":"Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback"}