CVE-2025-0638: high-severity vulnerability in NLnet Labs Routinator
Routinator crashes when illegal characters are present in manifest file names
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
NLnet Labs · RoutinatorRelated CVEs — NLnet Labs Routinator
In the same product, most dangerous first.
CVE-2021-43173—Hanging RRDP requestEPSS 1.4%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.1%CVE-2021-43172—Infinite length chain of RRDP repositoriesEPSS 1.1%CVE-2024-1622HIGHRoutinator terminates when RTR connection is reset too quickly after openingEPSS 1.0%CVE-2021-41531—Invalid RPKI data could disable Route Origin Validation on RTR clients.EPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.9%