What’s Vulnerable › Products

NLnet Labs Routinator vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your NLnet Labs Routinator version is affected

Latest NLnet Labs Routinator vulnerabilities

• CVE-2026-72758 — Routinator may exit on malformed ranges (CVSS 7.5)
• CVE-2026-72757 — Routinator HTTP server becomes unavailable with many unclosed connections (CVSS 5.3)
• CVE-2026-72756 — Routinator exits on malformed rsync URIs (CVSS 7.5)
• CVE-2026-72755 — Routinator stores TA certificate in cache without validation (CVSS 3.8)
• CVE-2026-72754 — Routinator exits when parsing an incorrect or very large CRL file (CVSS 7.5)
• CVE-2026-72753 — Routinator incorrectly handles delta updates (CVSS 8.2)
• CVE-2026-72752 — Routinator exits when requesting the output repeatedly (CVSS 6.5)
• CVE-2026-49235 — Routinator crashes on specifically crafted RRDP XML files (CVSS 7.5)
• CVE-2026-49234 — Routinator crashes on specifically crafted ASN strings in the API (CVSS 7.5)
• CVE-2026-49233 — Routinator cache path traversal using rogue rsync URIs (CVSS 7.5)
• CVE-2026-49232 — Routinator exits when accepting an incoming HTTP or RTR connection fails (CVSS 8.7)
• CVE-2025-0638 — Routinator crashes when illegal characters are present in manifest file names (CVSS 7.5)
• CVE-2024-1622 — Routinator terminates when RTR connection is reset too quickly after opening (CVSS 7.5)
• CVE-2023-39916 — Possible path traversal when storing RRDP responses (CVSS 6.5)
• CVE-2023-39915 — Crashes on parsing certain invalid RPKI objects (CVSS 7.5)
• CVE-2022-3029 — Fatal error on incorrect base64 data in RRDP (CVSS 7.5)
• CVE-2021-43174 — gzip transfer encoding caused out-of-memory crash (CVSS 7.5)
• CVE-2021-43173 — Hanging RRDP request (CVSS 7.5)
• CVE-2021-43172 — Infinite length chain of RRDP repositories (CVSS 7.5)
• CVE-2021-41531 — Invalid RPKI data could disable Route Origin Validation on RTR clients. (CVSS 7.5)
• CVE-2020-17366 — (CVSS 7.4)