{"action":"Upgrade cfrpki to 1.3.0-1 or later.","affected":[{"fixed":"1.3.0-1","introduced":"0"}],"component":"cfrpki","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1.3.0-1"],"id":"tcs_01M5NFVDXE2NP1MKX1QNH6HYXX","modified_at":"2026-10-23T18:03:30.501263226Z","published_at":"2021-09-09T14:15:09.397Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-3761","https://security-tracker.debian.org/tracker/CVE-2021-3761"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-3761","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-3761"}],"summary":"Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP \"MaxLength\" value, causing RTR sessions to terminate. An attacker can use this to disable RPKI Origin Validatio"}