CVE-2021-3761: OctoRPKI RPKI ROA maxLength Validation Vulnerability
Summary
CVE-2021-3761: Insufficient validation in github.com/cloudflare/cfrpki. Affects github.com/cloudflare/cfrpki versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3761 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OctoRPKI is an open-source tool developed by Cloudflare for managing and validating Resource Public Key Infrastructure (RPKI) data. RPKI is a cryptographic framework used to secure the Internet's routing infrastructure by verifying the legitimacy of IP address prefixes announced by Autonomous Systems (ASes). OctoRPKI plays a crucial role in ensuring the integrity and security of RPKI data by validating Route Origin Authorizations (ROAs) provided by Certificate Authorities (CAs).
Vulnerability Detail
The vulnerability in OctoRPKI lies in its lack of contextual out-of-bounds check when validating RPKI ROA maxLength values. This allows a CA issuer to manipulate OctoRPKI into emitting an invalid VRP "MaxLength" value, leading to the termination of RTR (Router-to-Router) sessions. An attacker can exploit this vulnerability to disable RPKI Origin Validation in a victim network, such as AS 13335 (Cloudflare), before launching a BGP hijack that would normally be rejected as "RPKI invalid." Additionally, the flapping of RTR sessions could cause BGP routing churn, resulting in availability issues.
How To Fix
Latest published version: v1.5.10 as of 23 Oct 2026
go get github.com/cloudflare/cfrpki@v1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating OctoRPKI to the latest version.
Conclusion
The vulnerability in OctoRPKI can be exploited by a CA issuer to disable RPKI Origin Validation in a victim network, potentially enabling BGP hijacking. It is crucial to update OctoRPKI to version 1.3.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
OctoRPKI is an open-source tool developed by Cloudflare for managing and validating Resource Public Key Infrastructure (RPKI) data. It plays a crucial role in securing the Internet's routing infrastructure.
RPKI stands for Resource Public Key Infrastructure. It is a cryptographic framework used to secure the Internet's routing infrastructure by verifying the legitimacy of IP address prefixes announced by Autonomous Systems (ASes).
A Route Origin Authorization (ROA) is a digital certificate that specifies the IP address prefixes that an Autonomous System (AS) is authorized to announce. It is used in RPKI to validate the origin of BGP route announcements.
A VRP "MaxLength" value is a parameter in RPKI that specifies the maximum length (in bits) of an IP address prefix allowed for a specific ROA. It is used to ensure that only valid IP address prefixes are announced by ASes.
BGP hijacking is a malicious activity where an attacker illegitimately announces IP address prefixes to redirect traffic intended for a specific destination. RPKI Origin Validation helps prevent BGP hijacking by verifying the legitimacy of route announcements.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
