CVE-2021-3912: Cloudflare Octorpki

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

Affected products

• Cloudflare Octorpki: before 1.3.0 (fixed in 1.3.0)
• Debian Debian Linux: version 11.0 only

Published 2021-11-11. Last modified 2026-06-17.