CVE-2021-3912: OctoRPKI GZIP Bomb Denial of Service
Summary
CVE-2021-3912: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OctoRPKI is a Go package developed by Cloudflare that is used for processing and managing Resource Public Key Infrastructure (RPKI) repositories. RPKI is a system that helps secure the Internet's routing infrastructure by providing a way to verify the authenticity and validity of IP address prefixes. OctoRPKI is susceptible to a denial of service vulnerability when processing a malicious repository containing a GZIP bomb. This vulnerability can cause OctoRPKI to crash due to running out of memory.
Vulnerability Detail
The vulnerability arises from OctoRPKI's approach of loading the entire contents of a repository into memory. In the case of a GZIP bomb, which is a compressed file designed to consume excessive memory when decompressed, OctoRPKI attempts to unzip it in memory, leading to a memory exhaustion condition. An attacker can exploit this vulnerability by creating a malicious repository that triggers OctoRPKI to consume all available memory, resulting in a crash. The impact of this vulnerability is a denial of service, preventing OctoRPKI from functioning properly.
How To Fix
Latest published version: v1.5.10 as of 23 Oct 2026
go get github.com/cloudflare/cfrpki@v1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating to the latest version of OctoRPKI.
Conclusion
The CVE-2021-3912 vulnerability in OctoRPKI exposes the package to a denial of service attack through the use of a malicious repository containing a GZIP bomb. Users are advised to update their OctoRPKI installation to version 1.4.0 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
OctoRPKI is a Go package developed by Cloudflare for managing Resource Public Key Infrastructure (RPKI) repositories. It helps secure the Internet's routing infrastructure by verifying the authenticity and validity of IP address prefixes.
A GZIP bomb is a compressed file that is designed to consume excessive memory when decompressed. It can be used as an attack vector to cause denial of service by exhausting the memory resources of a vulnerable application.
The vulnerability in OctoRPKI can lead to a denial of service, causing the application to crash and become unresponsive. This can disrupt the management and processing of RPKI repositories, potentially impacting the security of the Internet's routing infrastructure.
You can use the Vulert Playground at Vulert Scanner to check if your OctoRPKI installation is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability can be fixed by updating OctoRPKI to version 1.4.0 or later. The updated version includes modifications to handle GZIP bombs more efficiently and prevent memory exhaustion.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
