Executive brief
NLnet Labs Routinator, a software tool used to verify the validity of Internet routing data, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted XML file through the RPKI Repository Delta Protocol (RRDP) that causes the software to crash. This could disrupt the ability of network operators to validate routing information, potentially impacting the stability of Internet routing for the affected organization.
Technical details
A vulnerability exists in Routinator (specifically within its XML parsing dependency, quick-xml) where processing a maliciously crafted Document Type Definition (DTD) via the RPKI Repository Delta Protocol (RRDP) leads to a panic/crash. The issue is categorized as Uncontrolled Resource Consumption (CWE-400) and Improper Restriction of Recursive Entity References (CWE-776), commonly known as an XML Entity Expansion or 'billion laughs' style attack. An unauthenticated remote attacker can trigger this by hosting a malicious RRDP repository that the Routinator instance attempts to synchronize. The vulnerability is resolved by upgrading to Routinator 0.15.2, which incorporates quick-xml version 0.39.4 or later.
Affected products
- NLnet Labs Routinator <= 0.15.1
Timeline
- 2026-06-08: disclosed
- 2026-06-08: patched: Released in version 0.15.2
- 2026-06-08: advisory