CVE catalog
CVE-2026-49235
When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.
- Severity
- High · CVSS 8.7
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
A flaw was found in Routinator. A remote attacker could exploit this vulnerability by providing a specially crafted Document Type Definition (DTD) file through the Relying Party RPKI Data Protocol (RRDP). This could lead to Routinator crashing, resulting in a Denial of Service (DoS) for the affected system. This is an Important denial of service flaw in Routinator, which could be triggered remotely by an unauthenticated attacker providing a specially crafted Document Type Definition (DTD) file via the Relying Party RPKI Data Protocol (RRDP). Successful exploitation would lead to the Routinator service crashing, impacting the availability of RPKI validation services. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | routinator | Not reported | 0.15.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | routinator | cpe | Not reported | 0.15.2 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: