Infinite open connection causes OctoRPKI to hang forever

CAO 7.5CVE-2021-3909 · GHSA-8cvr-4rrf-f244 · GO-2022-0250 · Công bố 11/11/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-3909 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/cloudflare/cfrpki, octorpki (cloudflare).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.6%, cao hơn 75.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.4.0, 1.3.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/cloudflare/cfrpki Go	`< 1.4.0`	`1.4.0`
octorpki cloudflare	`< 1.3.0`	`1.3.0`

Mô tả

OctoRPKI (github.com/cloudflare/cfrpki/cmd/octorpki) does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

Patches

For more information

If you have any questions or comments about this advisory email us at [email protected]

Mô tả của NVD

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.