Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.

Affected: Go: github.com/pomerium/pomerium

## Summary

The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow (Pomerium Zero / hosted authenticate), the proxy's `/.pomerium/callback` endpoint is reachable without credentials and processes attacker-crafted HPKE-encrypted payloads before the sender's identity is validated. Because Pomerium's HPKE receiver public key is publicly served, an attacker can encrypt a decompression bomb, deliver it to the callback endpoint, and cause unbounded memory allocation — crashing or degrading the proxy process.

## Severity

**High** (CVSS 3.1: 7.5)

`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

- **Attack Vector:** Network — the `/.pomerium/callback` route on the proxy service is externally reachable. - **Attack Complexity:** Low — the receiver public key is publicly available at `/.well-known/pomerium/hpke-public-key`; no special conditions apply. - **Privileges Required:** None — the callback endpoint is intentionally pre-authentication (it is the OAuth landing page). - **User Interaction:** None - **Scope:** Unchanged — the DoS is confined to the Pomerium proxy process itself. - **Confidentiality Impact:** None - **Integrity Impact:** None - **Availability Impact:** High — repeated attacks can exhaust process memory and crash the proxy.

## Affected Component

- `pkg/hpke/url.go` — `decodeQueryStringV2` (line 171) - `internal/authenticateflow/stateless.go…