CVE-2022-3616: OctoRPKI crash when maximum iterations number is reached

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-28 · updated 2026-06-17
Weakness: CWE-754

Description

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Affected products

Cloudflare octorpki: before 1.4.4 — fixed in 1.4.4

How to fix

Upgrade to a fixed version: Cloudflare octorpki 1.4.4. Check the vendor advisory for mitigations.

References

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

Get alerted when CVE-2022-3616 or the next vulnerability affects your stack