Crashes on parsing certain invalid RPKI objects

published 2023-09-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-43613

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.

Patch / fix

fixed in 1

NLnet Labs Routinator 0.12.2

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-09-12)

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

NLnet Labs Routinator

Classification

Weakness

CWE-232 Improper Handling of Undefined Values
CWE-240 Improper Handling of Inconsistent Structural Elements

References

nlnetlabs.nl /downloads/routinator/CVE-2023-39915.txt
vendor-advisory

Sources

CVE List CVE-2023-39915
NVD CVE-2023-39915

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary