CVE-2023-39915: high-severity vulnerability in NLnet Labs Routinator
Crashes on parsing certain invalid RPKI objects
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
NLnet Labs · RoutinatorRelated CVEs — NLnet Labs Routinator
In the same product, most dangerous first.
CVE-2021-43173—Hanging RRDP requestEPSS 1.4%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.1%CVE-2021-43172—Infinite length chain of RRDP repositoriesEPSS 1.1%CVE-2024-1622HIGHRoutinator terminates when RTR connection is reset too quickly after openingEPSS 1.0%CVE-2021-41531—Invalid RPKI data could disable Route Origin Validation on RTR clients.EPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.9%