CVE-2022-3616 - CVE House
Back to Database
Status published Medium CVE-2022-3616

OctoRPKI crash when maximum iterations number is reached

Vulnerability Description

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-3616

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Donika Mirdita - Fraunhofer SIT, ATHENE
  • Haya Shulman - Fraunhofer SIT, ATHENE

References

More from Cloudflare

View All →
CVE-2025-7054
Infinite loop triggered by connection ID retirement
High 8.7
CVE-2025-4821
Incorrect congestion window growth by invalid ACK ranges
High 7.5
CVE-2025-4820
Incorrect congestion window growth by optimistic ACK
Medium 5.3
CVE-2025-13353
gokey allows secret recovery from a seed file without the master password
High 7.1
CVE-2025-0651
File symlink abuse might lead to deleting files belonging to SYSTEM user
Medium 6.1

Affected Vendor

Affected Software

OctoRPKI
Vulnerable Versions:
0

Timeline

Official Publish: October 28th, 2022
Last Modified: May 5th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-754 CWE-834

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1499 Endpoint Denial of Service
Impact
T1562 Impair Defenses
Defense Evasion
T1005 Data from Local System
Collection