NUL character in ROA causes OctoRPKI to crash

HIGH 7.5CVE-2021-3910 · GHSA-5mxh-2qfv-4g7j · GO-2022-0251 · Published 11/11/2021 · updated 17/06/2026

In short

CVE-2021-3910 is a HIGH (CVSS 7.5) vulnerability affecting github.com/cloudflare/cfrpki, octorpki (cloudflare).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.5% of all vulnerabilities.
Fix: update to 1.4.0 or later.

Package	Affected versions	Patched versions
github.com/cloudflare/cfrpki Go	`< 1.4.0`	`1.4.0`
octorpki cloudflare	`< 1.4.0`	`1.4.0`

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

If you have any questions or comments about this advisory email us at [email protected]

NVD description

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.4.0

1.4.0

< 1.4.0

1.4.0

Description

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

If you have any questions or comments about this advisory email us at [email protected]

NVD description

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

More vulnerabilities in github.com/cloudflare/cfrpki

See all →