CVE-2021-3908: Cloudflare Octorpki

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

Affected products

• Cloudflare Octorpki: before 1.3.0 (fixed in 1.3.0)
• Debian Debian Linux: version 11.0 only

Published 2021-11-11. Last modified 2026-06-17.