CVE-2024-45238

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-24 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.

Affected products

NICMx FORT-validator: before 1.6.3 — fixed in 1.6.3

How to fix

Upgrade to a fixed version: NICMx FORT-validator 1.6.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-45238 or the next vulnerability affects your stack