CVE-2023-0158: high-severity vulnerability in NLnet Labs Krill
Triggered crash on direct RRDP access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.7%
NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml" as would be expected, causes Krill to crash. If the built-in "/rrdp" endpoint is exposed directly to the internet, then malicious remote parties can cause the publication server to crash. The repository content is not affected by this, but the availability of the server and repository can cause issues if this attack is persistent and is not mitigated.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
NLnet Labs · KrillRelated CVEs — NLnet Labs Krill
In the same product, most dangerous first.
CVE-2026-109140HIGHKrill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" tokenEPSS 0.3%CVE-2026-109142HIGHKrill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same serverEPSS 0.3%CVE-2026-109141HIGHKrill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk importEPSS 0.3%