Every CVE Search/ Get API key

CVE-2022-3616

OctoRPKI crash when maximum iterations number is reached

5.4 MediumFix available

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.53%Down 0.4 points since Oct 28, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.4

OctoRPKI crash when maximum iterations number is reached

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Record
CVE-2022-3616
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-754, CWE-834
Updated
2026-11-02
EUVDEUVD-2022-7146 5.4

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Record
EUVD-2022-7146
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pmw9-567p-68pc 5.4

OctoRPKI crashes when max iterations is reached

Impact

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Specific Go Packages Affected

github.com/cloudflare/cfrpki/cmd/octorpki

Patches

This issue is fixed in v1.4.4

Workarounds

None.

Record
GHSA-pmw9-567p-68pc
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-754, CWE-834
Updated
2026-11-02
NVD 5.4

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Record
CVE-2022-3616
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-754, CWE-834
Updated
2026-11-02
OSV 5.4

OctoRPKI crash when maximum iterations number is reached

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Record
CVE-2022-3616
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-754, CWE-834
Updated
2026-11-02
OSVGHSA-pmw9-567p-68pc 5.4

OctoRPKI crashes when max iterations is reached

Impact

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Specific Go Packages Affected

github.com/cloudflare/cfrpki/cmd/octorpki

Patches

This issue is fixed in v1.4.4

Workarounds

None.

Record
GHSA-pmw9-567p-68pc
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-754, CWE-834
Updated
2026-11-02
OSVUBUNTU-CVE-2022-3616 5.4

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Record
UBUNTU-CVE-2022-3616
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-3616 No score

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Record
DEBIAN-CVE-2022-3616
Updated
2026-11-03
OSVGO-2022-1089 No score

OctoRPKI crashes when max iterations is reached in github.com/cloudflare/cfrpki

OctoRPKI crashes when max iterations is reached in github.com/cloudflare/cfrpki

Record
GO-2022-1089
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/cloudflare/cfrpki
Go
 through 1.4.3
1.4.4
cfrpki
Debian:12
 before 1.4.4-1
1.4.4-1
github.com/cloudflare/cfrpki
Go
 before 1.4.4
1.4.4
cfrpki
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.3.0-11.4.0-11.4.2-11.4.2-1ubuntu0.1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3616 is a medium vulnerability (CVSS 5.4) in Cloudflare Octorpki, published October 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in github.com/cloudflare/cfrpki 1.4.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open