Routinator
Monthly
Routinator, NLnet Labs' RPKI relying-party validator, can be driven into memory exhaustion by an AS range in RPKI data whose maximum value is lower than its minimum, leaving the validator unable to continue. The issue is remotely reachable without authentication per the CVSS vector and affects availability only; exploitation requires an attacker to place the malformed range into RPKI objects that a target Routinator instance fetches and validates. No CISA KEV entry or public exploit code is identified in the supplied data.
Routinator exits when it encounters an RRDP-delivered rsync URI whose path cannot be stored on disk, producing a denial of service in RPKI validation. The flaw affects Routinator instances that fetch repository content over RRDP (the default transport) and validate a publication point the attacker operates, compromises, or otherwise controls; an arbitrary off-path attacker cannot trigger it. The assessed impact is availability-only (CVSS 7.5), with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Routinator, NLnet Labs' RPKI relying-party validator, can be hung or terminated by a CRL fetched from the repository hierarchy it validates: a CRL carrying a very large number of entries drives the hang or out-of-memory path, while a CRL with an incorrect encoding causes the process to exit, producing an availability-only denial of service (CVSS 7.5, A:H, with no confidentiality or integrity impact). The CPE entry cpe:2.3:a:nlnet_labs:routinator is unversioned, so all releases are presumed affected until the vendor advisory names fixed versions. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical barrier is that an attacker must be able to serve the crafted CRL from a repository or CA inside a trusted RPKI validation path, and no authentication to Routinator itself is required.
Routinator, NLnet Labs' RPKI relying party validator, mishandles RRDP notification files by accepting delta entries with gaps and by not safely handling an excessive number of delta entries. A malicious or compromised RPKI publication point, or a network-path attacker able to serve crafted RRDP content, can cause incomplete RPKI data (integrity impact) or memory exhaustion and a crash (availability impact). No public exploit code or confirmed active exploitation is identified in the supplied data.
Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.
Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.
Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.
Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Resource exhaustion in NLnet Labs Routinator lets an attacker make the validator's HTTP server unavailable by opening a large number of connections that are never closed, consuming its finite open-connection capacity (CVSS 5.3, availability-only). Only operators who deliberately expose Routinator's HTTP or RTR server to untrusted networks are reachable; in a standard deployment bound to localhost or trusted internal networks the flaw is not remotely exposed. No KEV listing and no public exploit identified at time of analysis, so urgency is driven by deployment topology rather than an active campaign.
Routinator writes a newly retrieved trust anchor (TA) certificate fetched over HTTPS into its cache even when that certificate fails validation, so a failed update can overwrite the previously cached, known-good TA and leave the validator working from bad trust anchor material. Only deployments whose TAL points at an https:// TA URI are exposed, and the attacker must already hold the privileged position over that retrieval channel implied by PR:H - impact is limited to partial integrity and availability loss for RPKI validation (I:L/A:L, CVSS 3.8, C:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal is monitor.
NLnet Labs Routinator, an RPKI relying party validator, can be driven into memory exhaustion by a flood of concurrent requests to its HTTP JSON output endpoint, and can also abort with a stack overflow when a payload item carrying excessive metadata is discarded in a single operation. Only deployments that expose the HTTP or RTR server to untrusted networks are affected; the flaw is availability-only (no confidentiality or integrity impact), requires no authentication or user interaction, and no public exploit code was identified at the time of analysis. Vendor severity is 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while the independent assessment rates the attack vector as network (AV:N) rather than adjacent, and the priority decision is this_month.
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Routinator, NLnet Labs' RPKI relying-party validator, can be driven into memory exhaustion by an AS range in RPKI data whose maximum value is lower than its minimum, leaving the validator unable to continue. The issue is remotely reachable without authentication per the CVSS vector and affects availability only; exploitation requires an attacker to place the malformed range into RPKI objects that a target Routinator instance fetches and validates. No CISA KEV entry or public exploit code is identified in the supplied data.
Routinator exits when it encounters an RRDP-delivered rsync URI whose path cannot be stored on disk, producing a denial of service in RPKI validation. The flaw affects Routinator instances that fetch repository content over RRDP (the default transport) and validate a publication point the attacker operates, compromises, or otherwise controls; an arbitrary off-path attacker cannot trigger it. The assessed impact is availability-only (CVSS 7.5), with no confidentiality or integrity effect, and no public exploit identified at time of analysis.
Routinator, NLnet Labs' RPKI relying-party validator, can be hung or terminated by a CRL fetched from the repository hierarchy it validates: a CRL carrying a very large number of entries drives the hang or out-of-memory path, while a CRL with an incorrect encoding causes the process to exit, producing an availability-only denial of service (CVSS 7.5, A:H, with no confidentiality or integrity impact). The CPE entry cpe:2.3:a:nlnet_labs:routinator is unversioned, so all releases are presumed affected until the vendor advisory names fixed versions. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical barrier is that an attacker must be able to serve the crafted CRL from a repository or CA inside a trusted RPKI validation path, and no authentication to Routinator itself is required.
Routinator, NLnet Labs' RPKI relying party validator, mishandles RRDP notification files by accepting delta entries with gaps and by not safely handling an excessive number of delta entries. A malicious or compromised RPKI publication point, or a network-path attacker able to serve crafted RRDP content, can cause incomplete RPKI data (integrity impact) or memory exhaustion and a crash (availability impact). No public exploit code or confirmed active exploitation is identified in the supplied data.
Denial of service in NLnet Labs Routinator allows remote attackers to crash the RPKI validator by serving a crafted Document Type Definition (DTD) inside RRDP repository content. Exploitation requires no authentication or user interaction (CVSS 4.0 8.7, VA:H), and no public exploit identified at time of analysis. A successful crash halts RPKI relying-party processing, which can degrade route origin validation for networks that depend on Routinator output.
Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.
Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.
Denial of service in NLnet Labs Routinator allows remote unauthenticated attackers to crash the daemon by opening a large number of HTTP or RTR connections, exhausting file descriptors and triggering an unrecoverable exit. Only deployments exposing the HTTP or RTR server to untrusted networks are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Resource exhaustion in NLnet Labs Routinator lets an attacker make the validator's HTTP server unavailable by opening a large number of connections that are never closed, consuming its finite open-connection capacity (CVSS 5.3, availability-only). Only operators who deliberately expose Routinator's HTTP or RTR server to untrusted networks are reachable; in a standard deployment bound to localhost or trusted internal networks the flaw is not remotely exposed. No KEV listing and no public exploit identified at time of analysis, so urgency is driven by deployment topology rather than an active campaign.
Routinator writes a newly retrieved trust anchor (TA) certificate fetched over HTTPS into its cache even when that certificate fails validation, so a failed update can overwrite the previously cached, known-good TA and leave the validator working from bad trust anchor material. Only deployments whose TAL points at an https:// TA URI are exposed, and the attacker must already hold the privileged position over that retrieval channel implied by PR:H - impact is limited to partial integrity and availability loss for RPKI validation (I:L/A:L, CVSS 3.8, C:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal is monitor.
NLnet Labs Routinator, an RPKI relying party validator, can be driven into memory exhaustion by a flood of concurrent requests to its HTTP JSON output endpoint, and can also abort with a stack overflow when a payload item carrying excessive metadata is discarded in a single operation. Only deployments that expose the HTTP or RTR server to untrusted networks are affected; the flaw is availability-only (no confidentiality or integrity impact), requires no authentication or user interaction, and no public exploit code was identified at the time of analysis. Vendor severity is 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while the independent assessment rates the attack vector as network (AV:N) rather than adjacent, and the priority decision is this_month.
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.