High severity · published Sep 13, 2022
CVE-2022-3029
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is…
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may stop your network from validating route origins based on RPKI data. This vulnerability does not allow an attacker to manipulate RPKI data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routinator · Nlnetlabs
0.9.0 through 0.11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3029
Vendor Advisory
https://www.nlnetlabs.nl/downloads/routinator/CVE-2022-3029.txt
More from Routinator
7.5
CVE-2026-49235
Routinator crashes on specifically crafted RRDP XML files
7.5
CVE-2026-49234
Routinator crashes on specifically crafted ASN strings in the API
7.5
CVE-2026-49233
Routinator cache path traversal using rogue rsync URIs
7.5
CVE-2024-1622
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening
7.5
CVE-2023-39915
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects