OctoRPKI crash when maximum iterations number is reached
Priority LOW 33CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed OctoRPKI (Cloudflare): <1.4.4github.com/cloudflare/cfrpki (Go): 1.4.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | OctoRPKI | before <1.4.4 | <1.4.4 | Patch available | CNA |
| — | github.com/cloudflare/cfrpki (Go) | before 1.4.4 | 1.4.4 | Patch available | GHSA-pmw9-567p-68pc |
- OctoRPKI VendorCloudflare Affected before <1.4.4 Fixed in <1.4.4 Patch available CNA
- github.com/cloudflare/cfrpki (Go) Vendor— Affected before 1.4.4 Fixed in 1.4.4 Patch available GHSA-pmw9-567p-68pc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* | before 1.4.4 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* Versions before 1.4.4 Vulnerable ·Cloudflare
Remediation
- Fix · CNA OctoRPKI (Cloudflare) Fixed in <1.4.4
- Fix · GHSA-pmw9-567p-68pc github.com/cloudflare/cfrpki (Go) Fixed in 1.4.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3616
- 2026-10-03 Alias added: GHSA-pmw9-567p-68pc
References
More Cloudflare Octorpki vulnerabilities
- TI-2021-02817 Arbitrary filepath traversal via URI injection CVSS 3.1CRITICAL 9.8
- TI-2021-02819 Infinite open connection causes OctoRPKI to hang forever CVSS 3.1HIGH 7.5
- TI-2021-02820 NUL character in ROA causes OctoRPKI to crash CVSS 3.1HIGH 7.5
- TI-2021-02693 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values CVSS 3.1HIGH 7.5
- TI-2021-02875 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki CVSS 3.1HIGH 7.5
- TI-2021-02818 Infinite certificate chain depth results in OctoRPKI running forever CVSS 3.1HIGH 7.5
Sources
- CVE-2022-3616 · CVE Program
- CVE-2022-3616 · NVD
- FIRST EPSS
- GHSA-pmw9-567p-68pc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences