CVE catalog
CVE-2021-3761
cfrpki: CVE-2021-3761
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.22% · Oct 25, 2026
Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cfrpki | bookworm | 1.4.4-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cfrpki | source | bookworm | 1.3.0-1 | not yet assigned | Not reported | [994572] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
Observed: