CVE-2021-3911: Misconfigured IP address field in ROA leads to OctoRPKI crash in github.com/cloudflare/cfrpki
Summary
CVE-2021-3911: Panic on misconfigured IP address in github.com/cloudflare/cfrpki. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/cloudflare/cfrpki is a Go package that provides functionality for managing and validating Resource Public Key Infrastructure (RPKI) data. RPKI is a system that allows Internet Service Providers (ISPs) to verify the authenticity and validity of IP address allocations. OctoRPKI is a component of cfrpki that handles the validation and processing of Route Origin Authorizations (ROAs), which are used to specify the valid origin AS for a given IP prefix. ROAs contain an IP address field that specifies the range of IP addresses covered by the authorization.
Vulnerability Detail
The vulnerability occurs when a misconfigured IP address field is present in a ROA returned by a repository. If the IP address field contains too many bits for the IP address, it can cause OctoRPKI to crash. This vulnerability can be exploited by an attacker to disrupt the RPKI validation process and potentially cause denial of service. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.2.
How To Fix
Latest published version: v1.5.10 as of 23 Oct 2026
go get github.com/cloudflare/cfrpki@v1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of github.com/cloudflare/cfrpki to mitigate the risk.
Conclusion
In conclusion, the vulnerability CVE-2021-3911 affects the github.com/cloudflare/cfrpki package. It is a moderate severity vulnerability that can lead to a crash in OctoRPKI, potentially causing denial of service. Users should update to version 1.4.0 or later to fix this vulnerability. There are no known workarounds for this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
This vulnerability can lead to a crash in OctoRPKI, potentially disrupting the RPKI validation process and causing denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to analyze the software without requiring access to the code or installation.
Yes, a fix for this vulnerability is available in version 1.4.0 of github.com/cloudflare/cfrpki. Users should update to this version or later to mitigate the risk.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of github.com/cloudflare/cfrpki to mitigate the risk.
For more information about this vulnerability, you can email security@cloudflare.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
