Skip to content
CVE PROGRAM SOURCE RECORD4.4 Medium

CVE-2021-3909

Infinite open connection causes OctoRPKI to hang forever

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cloudflare

Description

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cloudflare octorpki

  • unspecified to < 1.4.0affected

References