Aller au contenu
en Se connecter
Non notée

CVE-2021-43174 NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP…

Description

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.

Produits et versions touchés

Produit Versions touchées Corrigé en
Routinator 0.10 premières → 0.10.1 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Routinator

Les 20 CVE de Routinator →
CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the… 7.5 Élevée CVE-2026-72757 Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving… 5.3 Moyenne CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such… 7.5 Élevée CVE-2026-72755 Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a… 3.8 Faible
Suivre cette CVE