Skip to content
fr Sign in
Not rated

CVE-2021-43174 NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP…

Description

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.

Affected products and versions

Product Affected versions Fixed in
Routinator 0.10 earliest → 0.10.1 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Routinator

The 20 CVEs of Routinator →
CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the… 7.5 High CVE-2026-72757 Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving… 5.3 Medium CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such… 7.5 High CVE-2026-72755 Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a… 3.8 Low
Track this CVE