x/vulndb: potential Go vuln in github.com/cloudflare/cfrpki: CVE-2021-3909

[GoVulnBot]

In CVE-2021-3909, the reference URL github.com/cloudflare/cfrpki (and possibly others) refers to something in Go.

module: github.com/cloudflare/cfrpki
package: octorpki
description: |
  OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.
cves:
- CVE-2021-3909
links:
  context:
  - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8cvr-4rrf-f244

See doc/triage.md for instructions on how to triage this report.

[neild]

Vulnerability in tool, not importable package.

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607215 mentions this issue: data/reports: unexclude 20 reports (13)