HIGHGo
GHSA-3jhm-87m6-x959· GO-2022-0496Path traversal mitigation bypass in OctoRPKI
Modified: 2/4/2026
package
Go/github.com/cloudflare/cfrpki
pkg:go/github.com/cloudflare/cfrpki
HIGH7.5Go
GHSA-3pqh-p72c-fj85· CVE-2021-3978, GO-2022-0580Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki
Modified: 1/29/2025
HIGH7.5Go
GHSA-5mxh-2qfv-4g7j· CVE-2021-3910, GO-2022-0251NUL character in ROA causes OctoRPKI to crash
Modified: 7/8/2026
LOWGo
GHSA-8459-6rc9-8vf8· CVE-2021-3907, GHSA-cqh2-vc2f-q4fhPath traversal in github.com/cloudflare/cfrpki/cmd/octorpki
Modified: 1/14/2025
MEDIUM4.4Go
GHSA-8cvr-4rrf-f244· CVE-2021-3909, GO-2022-0250Infinite open connection causes OctoRPKI to hang forever
Modified: 7/8/2026
HIGH7.5Go
GHSA-c8xp-8mf3-62h9· CVE-2021-3761, GO-2022-0246OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Modified: 7/8/2026
HIGH7.4Go
GHSA-cqh2-vc2f-q4fh· CVE-2021-3907, GHSA-8459-6rc9-8vf8Arbitrary filepath traversal via URI injection
Modified: 2/4/2026
MEDIUM5.9Go
GHSA-g5gj-9ggf-9vmq· CVE-2021-3908, GO-2022-0249Infinite certificate chain depth results in OctoRPKI running forever
Modified: 7/8/2026
MEDIUM4.2Go
GHSA-g9wh-3vrx-r7hg· CVE-2021-3912, GO-2022-0253OctoRPKI crashes when processing GZIP bomb returned via malicious repository
Modified: 7/8/2026
MEDIUM5.4Go
GHSA-pmw9-567p-68pc· CVE-2022-3616, GO-2022-1089OctoRPKI crashes when max iterations is reached
Modified: 7/8/2026
MEDIUM4.2Go
GHSA-w6ww-fmfx-2x22· CVE-2021-3911, GO-2022-0252Misconfigured IP address field in ROA leads to OctoRPKI crash
Modified: 7/8/2026
—Go
GO-2022-0246· CVE-2021-3761, GHSA-c8xp-8mf3-62h9Insufficient validation in github.com/cloudflare/cfrpki
Modified: 5/20/2024
—Go
GO-2022-0248· CVE-2021-3907, GHSA-8459-6rc9-8vf8Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki
Modified: 2/4/2026
—Go
GO-2022-0249· CVE-2021-3908, GHSA-g5gj-9ggf-9vmqInfinite certificate chain depth results in OctoRPKI running forever in github.com/cloudflare/cfrpki
Modified: 3/3/2026
—Go
GO-2022-0250· CVE-2021-3909, GHSA-8cvr-4rrf-f244Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki
Modified: 3/3/2026
—Go
GO-2022-0251· CVE-2021-3910, GHSA-5mxh-2qfv-4g7jPanic on NUL character in ROA in github.com/cloudflare/cfrpki
Modified: 5/20/2024
—Go
GO-2022-0252· CVE-2021-3911, GHSA-w6ww-fmfx-2x22Panic on misconfigured IP address in github.com/cloudflare/cfrpki
Modified: 5/20/2024
—Go
GO-2022-0253· CVE-2021-3912, GHSA-g9wh-3vrx-r7hgResource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki
Modified: 5/20/2024
—Go
GO-2022-0496· GHSA-3jhm-87m6-x959Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki
Modified: 3/3/2026
—Go
GO-2022-0580· CVE-2021-3978, GHSA-3pqh-p72c-fj85Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki in github.com/cloudflare/cfrpki
Modified: 3/3/2026
—Go
GO-2022-1089· CVE-2022-3616, GHSA-pmw9-567p-68pcOctoRPKI crashes when max iterations is reached in github.com/cloudflare/cfrpki
Modified: 3/3/2026