How severe is CVE-2022-3616?

CVE-2022-3616 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity low, and availability high.

Is CVE-2022-3616 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-3616?

CVE-2022-3616 affects Cloudflare Octorpki. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-3616?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-3616 published?

CVE-2022-3616 was published on 2022-10-28 and last updated on 2026-06-17.

CVE-2022-3616

CVE-2022-3616 is a medium-severity vulnerability in Cloudflare Octorpki with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-834.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-834
Affected product: Cloudflare Octorpki
Published: 2022-10-28
Last modified: 2026-06-17

Description

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Frequently asked questions

What is CVE-2022-3616?: Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
How severe is CVE-2022-3616?: CVE-2022-3616 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity low, and availability high.
Is CVE-2022-3616 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-3616?: CVE-2022-3616 affects Cloudflare Octorpki. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-3616?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-3616 published?: CVE-2022-3616 was published on 2022-10-28 and last updated on 2026-06-17.

References

https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc

Affected products (1)

cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:*

More vulnerabilities in Cloudflare Octorpki

CVE-2021-3978 — High (CVSS 7.5): When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set…
CVE-2021-3761 — High (CVSS 7.5): Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into emitting an invalid VRP "MaxLength" value, causing RTR…
CVE-2021-3907 — High (CVSS 7.4): OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex.…
CVE-2021-3908 — Medium (CVSS 5.9): OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion,…
CVE-2021-3910 — Medium (CVSS 4.4): OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).
CVE-2021-3909 — Medium (CVSS 4.4): OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes…

All CVEs affecting Cloudflare Octorpki →

Other CWE-834 (Excessive Iteration) vulnerabilities

CVE-2017-12587 — High (CVSS 8.8): ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.
CVE-2025-62707 — High (CVSS 7.5): pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this…
CVE-2025-56571 — High (CVSS 7.5): Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper…
CVE-2024-4227 — High (CVSS 7.5): In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when…
CVE-2023-49316 — High (CVSS 7.5): In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.
CVE-2023-5632 — High (CVSS 7.5): In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data…

Browse all CWE-834 (Excessive Iteration) vulnerabilities →