CVE-2021-3911
Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Record
CVE-2021-3911- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-2404
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Record
EUVD-2021-2404- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w6ww-fmfx-2x22
Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Patches
For more information
If you have any questions or comments about this advisory email us at [email protected]
- Record
GHSA-w6ww-fmfx-2x22- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-252
- Updated
- 2026-11-02
NVD
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Record
CVE-2021-3911- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20, CWE-252
- Updated
- 2026-11-02
OSV
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Record
CVE-2021-3911- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3911
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Record
DEBIAN-CVE-2021-3911- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-w6ww-fmfx-2x22
Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
Patches
For more information
If you have any questions or comments about this advisory email us at [email protected]
- Record
GHSA-w6ww-fmfx-2x22- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-252
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3911
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
- Record
UBUNTU-CVE-2021-3911- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2022-0252 No score
Panic on misconfigured IP address in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits.
- Record
GO-2022-0252- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cloudflare/cfrpkiGo |
before 1.4.0 | 1.4.0 |
cfrpkiDebian:12 |
before 1.4.0-1 | 1.4.0-1 |
cfrpkiDebian:11 From an advisory covering 10 CVEs |
before 1.4.2-1~deb11u1, plus listed versions 1.2.2-11.3.0-11.4.0-1 |
1.4.2-1~deb11u1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3911 is a medium vulnerability (CVSS 4.2) in Cloudflare Octorpki, published November 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in github.com/cloudflare/cfrpki 1.4.0.