{"id":"CVE-2022-3616","state":"PUBLISHED","title":"OctoRPKI crash when maximum iterations number is reached","description":"Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n","publishedAt":"2022-10-28T06:24:44.189Z","updatedAt":"2025-05-05T19:19:50.911Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H","source":"cloudflare"},"assigner":"cloudflare","products":["Cloudflare OctoRPKI"],"affected":[{"vendor":"Cloudflare","product":"OctoRPKI","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"<1.4.4","versionType":"semver"}],"platforms":["Go"],"repo":"https://github.com/cloudflare/cfrpki"}],"references":["https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"],"weaknesses":["CWE-754","CWE-834"],"ingestedAt":"2026-10-29T19:50:32.060Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/3xxx/CVE-2022-3616.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-3616","state":"PUBLISHED","datePublished":"2022-10-28T06:24:44.189Z","dateUpdated":"2025-05-05T19:19:50.911Z","assignerShortName":"cloudflare","assignerOrgId":"a22f1246-ba21-4bb4-a601-ad51614c1513","requesterUserId":"25b7b156-39bf-4f6b-8c25-8bc69c5c5e82","dateReserved":"2022-10-20T11:13:34.797Z"},"containers":{"cna":{"title":"OctoRPKI crash when maximum iterations number is reached","descriptions":[{"lang":"en","value":"Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.\n\n"}],"affected":[{"vendor":"Cloudflare","product":"OctoRPKI","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"<1.4.4","versionType":"semver"}],"platforms":["Go"],"repo":"https://github.com/cloudflare/cfrpki"}],"references":[{"url":"https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-754","description":"CWE-754 Improper Check for Unusual or Exceptional Conditions","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-834","description":"CWE-834 Excessive Iteration","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cloudflare","orgId":"a22f1246-ba21-4bb4-a601-ad51614c1513","dateUpdated":"2023-03-29T08:43:36.139Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Donika Mirdita - Fraunhofer SIT, ATHENE "},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Haya Shulman - Fraunhofer SIT, ATHENE"}],"impacts":[{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153 Input Data Manipulation"}]}],"source":{"advisory":"GHSA-pmw9-567p-68pc","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:14:03.299Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-05T19:18:52.761100Z","id":"CVE-2022-3616","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-05T19:19:50.911Z"}}]}}}