GHSA-g9wh-3vrx-r7hgMediumCVSS 4.2

OctoRPKI crashes when processing GZIP bomb returned via malicious repository

Published
November 10, 2021
Last Modified
February 14, 2023

🔗 CVE IDs covered (1)

CVE-2021-3912 →

📋 Description

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

Patches

For more information

If you have any questions or comments about this advisory email us at [email protected]

🎯 Affected products1

  • go/github.com/cloudflare/cfrpki:< 1.4.0

🔗 References (6)