{
  "cveId": "CVE-2022-3616",
  "url": "https://patchblox.com/security/cve/CVE-2022-3616",
  "summary": "CVE-2022-3616 is fixed in cfrpki on 1 platform by DEBIAN-CVE-2022-3616 (version 1.4.4-1), released October 28, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "cfrpki: Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter",
  "description": "Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to\u00A0Donika Mirdita and\u00A0Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.",
  "published": "2022-10-28T07:15:16Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00527,
  "epssPercentile": 0.44854,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "cfrpki",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.4.4-1",
      "fix": "DEBIAN-CVE-2022-3616",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-3616",
      "released": "2022-10-28T07:15:16Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}