CVE-2021-3911: Cloudflare Octorpki

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

Affected products

• Cloudflare Octorpki: before 1.3.0 (fixed in 1.3.0)
• Debian Debian Linux: version 11.0 only

Published 2021-11-11. Last modified 2026-06-17.