The vulnerability exists in Pomerium's HPKE V2 URL decode path (pkg/hpke/url.go) where the decodeQueryStringV2 function decompresses zstd data without limiting the decompressed output size. The callback endpoint /.pomerium/callback is accessible without credentials and processes HPKE-encrypted payloads before validating the sender's public key. Since the HPKE receiver public key is public, an attacker can craft a payload that decompresses to a very large size, exhausting memory resources and causing the proxy to crash or degrade. The decompression occurs before sender validation, allowing the attack to succeed without authentication. The issue is due to unbounded resource consumption (CWE-400) and improper validation of input quantity (CWE-1284).

An attacker can remotely cause a denial-of-service by sending specially crafted HPKE-encrypted payloads containing zstd decompression bombs to the proxy's callback endpoint. This leads to unbounded memory allocation, exhausting process memory and crashing or degrading the Pomerium proxy. There is no impact on confidentiality or integrity, and no privileges or user interaction are required to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the /.pomerium/callback endpoint or deploying network-level protections to limit exposure. Monitor for unusual memory usage patterns on the proxy process. Note that the vendor advisory or patch links are not provided, so verify with official Pomerium sources for updates.