CVE-2022-3616

OctoRPKI crash when maximum iterations number is reached

State: Published
Severity: 5.4 Medium
Published: Oct 28, 2022
Updated: May 5, 2025
Reserved: Oct 20, 2022

Description

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H	cloudflare

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-834 Excessive Iteration

Affected Products

Product	Versions
OctoRPKICloudflare	before <1.4.4Affected

References

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.