High severity · published Sep 13, 2023
CVE-2023-39915
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routinator · Nlnetlabs
before 0.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39915
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39915
Vendor Advisory
https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt
More from Routinator
7.5
CVE-2026-49235
Routinator crashes on specifically crafted RRDP XML files
7.5
CVE-2026-49234
Routinator crashes on specifically crafted ASN strings in the API
7.5
CVE-2026-49233
Routinator cache path traversal using rogue rsync URIs
7.5
CVE-2024-1622
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening
7.5
CVE-2022-3029
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is…