CVE-2021-3910: Cloudflare Octorpki

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).

Affected products

• Cloudflare Octorpki: before 1.4.0 (fixed in 1.4.0)
• Debian Debian Linux: version 11.0 only

Published 2021-11-11. Last modified 2026-06-17.