VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/cloudflare/cfrpki: vulnerability history, versions and safety

github.com/cloudflare/cfrpki is a package in the Go ecosystem. Vulert records 26 vulnerabilities for it across 120 releases, from Sep 2021 to Aug 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
26 vulnerabilities recorded H5 M5 L1 U15
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/cloudflare/cfrpki vulnerabilities

Vulert verdict on github.com/cloudflare/cfrpki v1.5.10 i

Updated on 23 Oct 2026

Action needed: v1.5.10 has 26 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Maintaining
  • Popularity Niche
  • Community Quiet

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.5.10 — affected i
  • Vulnerabilities on record 26 over 2 years · 0 in the last year i
  • Latest disclosure 21 Aug 2024 i
  • Highest CVSS 7.5 i
  • With no published fix 0 i
  • Stars 179 i
  • OpenSSF scorecard 4/10 i
  • Last release 41 months ago i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/cloudflare/cfrpki, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.5.11-0.20240229145710-932c7596bb6f 29 Feb 2024 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.10 28 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.10-0.20230428095047-80909937cc41 28 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.9 27 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.8 19 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.7 19 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.6 18 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.5 05 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.5-0.20230405140818-ceea94231012 05 Apr 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.5-0.20230331135923-db71b1228a58 31 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.4 31 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.3 30 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.2-0.20230329135539-41a36a53e8f6 29 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.2 29 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.1 27 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.5.0 21 Mar 2023 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.4 18 Oct 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.4-0.20221017140358-10191d9042f0 17 Oct 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.4-0.20220426113826-bdcccaf2c46b 26 Apr 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.4-0.20220308173501-c71d48f3a7d6 08 Mar 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.3 18 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.4-0.20220218113633-8c9ad3dcdb00 18 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.4-0.20220217141700-ba5c05948731 17 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.3-0.20220211111059-eb9cc4db7b7b 11 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v0.0.0-20220207181313-f5aeb07ff580 07 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.3-0.20220207181313-f5aeb07ff580 07 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.3-0.20220204155541-d189c1f78265 04 Feb 2022 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.2 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.2-0.20211118205521-6ef2aeef96fc 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.1 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.1-0.20211118131213-9c7bc2a54f32 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.1-0.20211118102900-8133a024139a 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.1-0.20211118102835-c9544c992488 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.1-0.20211118102803-88b536142e10 18 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.1-0.20211109222143-488a33489c6b 09 Nov 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.4.0 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211026171059-32961e7a41ca 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211026171027-7ca2435a078b 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211026171017-f0c105a2ea8f 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211026170923-a6eaae8c9142 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211026170908-db6842cbb6c9 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211026170819-d09d0e2fc254 26 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211021215000-3e6193cb104f 21 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211021191142-a7ac15483f59 21 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211020184519-76f0f7a98da0 20 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211019214140-648658b1b176 19 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211019190953-4d801c2f5d6f 19 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211019183135-dbc038f83197 19 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211019182951-71ac74e691dc 19 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211019174454-a053a808feeb 19 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211018220850-2882307febd6 18 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211015185325-cb2ab377b9b7 15 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211014163603-8721e758ee24 14 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211013184704-69bf56a594a8 13 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211013183859-7d3aeb8f82c0 13 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211013182930-e2eb63591df0 13 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211013182500-b28081501181 13 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.1-0.20211013181928-793fd0a58a86 13 Oct 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.3.0 19 Aug 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.3-0.20210818235239-433b9a587f3f 18 Aug 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.3-0.20210813201225-a288d9941c3c 13 Aug 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.3-0.20210813201209-a4f6a4c8061e 13 Aug 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.3-0.20210813200219-06b015dff2c5 13 Aug 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.3-0.20210511160613-f0312021e106 11 May 2021 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.2 08 Dec 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.2-0.20201208232212-2d643f1f542c 08 Dec 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.2-0.20201208214504-145f0b92a62d 08 Dec 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.2-0.20201203225033-0e37b53a50eb 03 Dec 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.1 24 Nov 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.1-0.20201123230431-74d90fbced28 23 Nov 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.1-0.20201121013837-e6275b1a88a6 21 Nov 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.1-0.20201117181110-6f3af4a57209 17 Nov 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.1-0.20201114023541-5246d5153408 14 Nov 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.1-0.20201029215207-6c1872dfdd57 29 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0 29 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201027173619-233320d10963 27 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201027173552-b547c472e09b 27 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201027173337-fc0bbe1f8051 27 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201027171839-5711567cbbd2 27 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201026152226-8b794354a704 26 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201026151901-22daf22caeed 26 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201024005905-b98ed20a8ef8 24 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201024001825-a53ce7743168 24 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023224549-8c20d8fc1912 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023224521-123347dc975a 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023224507-17ccedd7ec49 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023214138-ac09d29c4039 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023213930-3f417d85e01f 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023213930-9dee31970818 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023213930-d066b898288f 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023213930-f34f0463ffd3 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201023213903-d291afb0e1f9 23 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201021002917-901822c72a10 21 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201021001147-5337314440cd 21 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201020213235-ff2167e6916e 20 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201016000006-53a74f362148 16 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20201015235455-4164f71462f6 15 Oct 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20200824125312-b1fdccd17fcc 24 Aug 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.1.4-0.20200817144320-5a115a699b2f 17 Aug 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20200817144320-5a115a699b2f 17 Aug 2020 H5 M5 L1 U15 BSD-3-Clause Yes Details →
v1.2.0-pre.0.20200817144249-a9450145c44e 17 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200813032314-67f678e82175 13 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812231841-01881013243a 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812231437-30844aa62fbc 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812231109-7e5830328803 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812230824-0fef89509093 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812230636-4ffc2bd14970 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812230241-33f5d3be0d94 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812230107-143bb5f6c2ab 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812225733-19ccb8a825a2 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812225252-0cddc2165e5c 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812223251-fe98e4a81ddc 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812221716-bacc4747413c 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812221429-c84cd1d706ae 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812212716-9d056d1c2f54 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812203811-82f361e9debe 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200812202752-7c21cc6b34e5 12 Aug 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200730094125-5deb564b4db9 30 Jul 2020 H5 M5 L1 U15 — Yes Details →
v1.1.5-0.20200730093953-5378c1584eaa 30 Jul 2020 H5 M5 L1 U15 — Yes Details →
v1.2.0-pre.0.20200730092420-c63f832ae9fa 30 Jul 2020 H5 M5 L1 U15 — Yes Details →

The newest 120 of 241 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 8
  • 2022 13
  • 2024 5

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 26 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/cloudflare/cfrpki

The 5 most severe of 26 vulnerabilities recorded for this package

Search all 26 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2021-3978: Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki 7.5 high 1.4.2 19 Nov 2021
CVE-2021-3761: OctoRPKI RPKI ROA maxLength Validation Vulnerability 7.5 high 1.3.0 07 Sep 2021
CVE-2021-3910: NUL character in ROA causes OctoRPKI to crash 7.5 high 1.4.0 10 Nov 2021
CVE-2021-3907: Arbitrary filepath traversal via URI injection in github.com/cloudflare/cfrpki 7.4 high 1.4.4 10 Nov 2021
CVE-2021-3908: Infinite certificate chain depth in OctoRPKI 5.9 medium 1.4.0 10 Nov 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/cloudflare/cfrpki

Is github.com/cloudflare/cfrpki safe to use?

Vulert records 26 vulnerabilities for github.com/cloudflare/cfrpki in Go: 0 critical, 5 high, 5 medium and 1 low, plus 15 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/cloudflare/cfrpki's Vulert package health score?

Vulert scores github.com/cloudflare/cfrpki 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/cloudflare/cfrpki affected?

Yes. v1.5.10, the version you would install today, has 26 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/cloudflare/cfrpki should I use?

v1.5.10 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/cloudflare/cfrpki have?

26 vulnerabilities are recorded for github.com/cloudflare/cfrpki in the Go ecosystem: 0 critical, 5 high, 5 medium and 1 low, plus 15 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/cloudflare/cfrpki vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/cloudflare/cfrpki in the last 12 months, and the oldest entry in this database dates to 07 Sep 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/cloudflare/cfrpki are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/cloudflare/cfrpki for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/cloudflare/cfrpki version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.