CVE-2021-3910: Panic on NUL character in ROA in github.com/cloudflare/cfrpki
Summary
CVE-2021-3910: Panic on NUL character in ROA in github.com/cloudflare/cfrpki. Affects github.com/cloudflare/cfrpki versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- cfrpki · Debian:11
The same CVE-2021-3910 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/cloudflare/cfrpki, which is written in Go. It is a library for validating and processing Resource Public Key Infrastructure (RPKI) data. RPKI is a system that allows internet service providers to verify the authenticity of IP address prefixes. The package includes functionality for decoding and validating ROAs (Route Origin Authorizations) which are used to specify the valid origin AS (Autonomous System) for a given IP prefix. The vulnerability in this package occurs when a repository returns an invalid ROA that is only an encoded NUL character (\0).
Vulnerability Detail
The vulnerability in github.com/cloudflare/cfrpki allows an attacker to cause a panic in the OctoRPKI library when an invalid ROA containing only a NUL character is encountered. This can lead to a denial of service (DoS) condition, as the application crashes. The issue arises due to improper handling of the invalid input, causing the panic. The impact of this vulnerability is limited to applications that use the affected library and process RPKI data.
How To Fix
Latest published version: v1.5.10 as of 23 Oct 2026
go get github.com/cloudflare/cfrpki@v1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
go get github.com/cloudflare/cfrpki@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that the RPKI repositories they use do not return invalid ROAs containing only a NUL character. Additionally, implementing proper error handling and input validation in the application can help prevent crashes in case of invalid input.
Conclusion
In conclusion, the vulnerability in github.com/cloudflare/cfrpki allows an attacker to cause a panic in the OctoRPKI library by providing an invalid ROA containing only a NUL character. This can lead to a denial of service (DoS) condition in applications that use the library and process RPKI data. To fix the vulnerability, developers should update the package to version 1.4.0 or later. Mitigation can also be achieved by ensuring the RPKI repositories used do not return such invalid ROAs and implementing proper error handling and input validation in the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/cfrpki →
FAQ
The vulnerability can lead to a denial of service (DoS) condition in applications that use the github.com/cloudflare/cfrpki library and process RPKI data. The application may crash when encountering an invalid ROA containing only a NUL character.
To fix this vulnerability, update the github.com/cloudflare/cfrpki package to version 1.4.0 or later. This version includes a fix for the issue.
No, versions 0 and earlier are affected. The vulnerability has been fixed in version 1.4.0.
While updating the package is the recommended solution, you can mitigate the risk by ensuring that the RPKI repositories you use do not return invalid ROAs containing only a NUL character. Additionally, implementing proper error handling and input validation in your application can help prevent crashes in case of invalid input.
You can find more information about this vulnerability in the Go Vulnerability Database at https://pkg.go.dev/vuln/GO-2022-0251.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cloudflare/cfrpki.
