Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2021-3912

OctoRPKI crashes when processing GZIP bomb returned via malicious repository

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cloudflare

Description

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cloudflare octorpki

  • unspecified to < 1.4.0affected

References