TI-2021-02693 Aliases CVE-2021-3761 GHSA-c8xp-8mf3-62h9

OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values

LOW 35CWE-787Published 2021-09-09 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service, Spoofing
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-787, CWE-295 and the CVSS impact.

Summary

Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.

Why it matters now

EPSS 0.01216 68th percentileScored 2026-11-07

Fix Fixed octorpki (Cloudflare): 1.3.0github.com/cloudflare/cfrpki (Go): 1.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloudflare	octorpki	before 1.3.0	1.3.0	Patch available	CNA
—	github.com/cloudflare/cfrpki (Go)	before 1.3.0	1.3.0	Patch available	GHSA-c8xp-8mf3-62h9

octorpki VendorCloudflare Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
github.com/cloudflare/cfrpki (Go) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-c8xp-8mf3-62h9

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudflare:octorpki::::::::	before 1.3.0	Vulnerable	Cloudflare
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Cloudflare
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Fix · CNA octorpki (Cloudflare) Fixed in 1.3.0
Fix · GHSA-c8xp-8mf3-62h9 github.com/cloudflare/cfrpki (Go) Fixed in 1.3.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-3761
2026-10-03 Alias added: GHSA-c8xp-8mf3-62h9

References

Patch 1

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9

Advisory 2

Other 4

TI-2021-02817 Arbitrary filepath traversal via URI injection CVSS 3.1CRITICAL 9.8
TI-2021-02819 Infinite open connection causes OctoRPKI to hang forever CVSS 3.1HIGH 7.5
TI-2021-02820 NUL character in ROA causes OctoRPKI to crash CVSS 3.1HIGH 7.5
TI-2021-02875 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki CVSS 3.1HIGH 7.5
TI-2021-02818 Infinite certificate chain depth results in OctoRPKI running forever CVSS 3.1HIGH 7.5
TI-2022-03327 OctoRPKI crash when maximum iterations number is reached CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences