Octorpki
Vendor:
First CVE: Sep 9, 2021 · Active for 4 years
9
Total CVEs
More Total CVEs than 86% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 48% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Octorpki over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 9, 2021
4 years ago
Most Recent CVE
Jan 29, 2025
544 days ago
CVE Severity & Scoring
Octorpki9 CVEs
33%
56%
11%
All CVEs352,785 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (11.1%)
Network8 (88.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (77.8%)
Unknown0 (0.0%)
Required2 (22.2%)
Privileges Required
Low1 (11.1%)
High0 (0.0%)
None8 (88.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-3907CRITICAL OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would | Nov 11, 2021 | 9.8 | 28 | NO | NO |
CVE-2022-3616HIGH Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from f | Oct 28, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-3910HIGH OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character). | Nov 11, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-3909HIGH OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI | Nov 11, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-3908HIGH OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. | Nov 11, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-3761HIGH Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable R | Sep 9, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-3912MEDIUM OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoR | Nov 11, 2021 | 6.5 | 23 | NO | NO |
CVE-2021-3911MEDIUM If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. | Nov 11, 2021 | 6.5 | 23 | NO | NO |
CVE-2021-3978MEDIUM When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to r | Jan 29, 2025 | 5.5 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Octorpki
Top CWEs
Versions
No cataloged versions.