CVE-2021-3910: NUL character in ROA causes OctoRPKI to crash
Summary
CVE-2021-3910: Panic on NUL character in ROA in github.com/cloudflare/cfrpki. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3910 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/cloudflare/cfrpki, which is written in Go. It is a component of OctoRPKI, a tool used for managing and validating Resource Public Key Infrastructure (RPKI) data. OctoRPKI is responsible for processing and verifying Route Origin Authorizations (ROAs) from repositories. ROAs are used to validate the origin of IP prefixes in BGP routing. This vulnerability affects versions prior to 1.4.0 of the package.
Vulnerability Detail
OctoRPKI crashes when encountering a repository that returns an invalid ROA containing an encoded NUL (\0) character. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition, leading to the disruption of RPKI data processing and validation. The presence of the NUL character causes OctoRPKI to crash, rendering the tool inoperable.
How To Fix
Latest published version: v1.5.10 as of 23 Oct 2026
go get github.com/cloudflare/cfrpki@v1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the github.com/cloudflare/cfrpki package prior to version 1.4.0 is vulnerable to a crash caused by an invalid ROA containing a NUL character. To mitigate this vulnerability, it is recommended to update to version 1.4.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
OctoRPKI is a tool used for managing and validating Resource Public Key Infrastructure (RPKI) data. It is responsible for processing and verifying Route Origin Authorizations (ROAs) from repositories.
A Route Origin Authorization (ROA) is a digital certificate that validates the origin of IP prefixes in BGP routing. It is used to ensure the legitimacy of routing information.
This vulnerability can lead to a denial-of-service (DoS) condition in OctoRPKI, causing the tool to crash and become inoperable. This can disrupt RPKI data processing and validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For more information about this vulnerability, you can refer to the advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-5mxh-2qfv-4g7j/GHSA-5mxh-2qfv-4g7j.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
