{"action":"Upgrade github.com/cloudflare/cfrpki to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"github.com/cloudflare/cfrpki","cve_ids":["CVE-2021-3761"],"ecosystem":"Go","epss":0.01216,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-c8xp-8mf3-62h9","id":"tcs_01M5KF71N7C274PVNT1STF84JC","modified_at":"2026-07-08T06:27:57.548504664Z","published_at":"2021-09-07T23:02:18Z","references":["https://osv.dev/vulnerability/GHSA-c8xp-8mf3-62h9","https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9","https://nvd.nist.gov/vuln/detail/CVE-2021-3761","https://github.com/cloudflare/cfrpki/pull/90","https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422","https://github.com/cloudflare/cfrpki/releases/tag/v1.3.0","https://pkg.go.dev/vuln/GO-2022-0246","https://www.debian.org/security/2022/dsa-5041"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-c8xp-8mf3-62h9","url":"https://osv.dev/vulnerability/GHSA-c8xp-8mf3-62h9"}],"summary":"OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values"}