CVE-2026-49235: Routinator RPKI Validator Denial of Service via Malicious RRDP Document

Technical summary

CVE-2026-49235 is a denial-of-service vulnerability in Routinator stemming from improper handling of malformed Document Type Definitions (DTDs) in RRDP (RPKI Repository Delta Protocol) payloads. When Routinator processes a specially constructed DTD, the application crashes due to insufficient input validation, causing an uncontrolled exception. The vulnerability is reachable over the network, requires no privileges or user interaction, and affects the availability vector of the system. The underlying weakness is classified under CWE-755 (Improper Handling of Exceptional Conditions).

Business impact

Organizations operating RPKI validation infrastructure depend on Routinator to maintain route origin validation, a critical component of BGP security. Service crashes disrupt the continuous synchronization of RPKI data, potentially leaving networks unable to validate route announcements. In environments where Routinator is the sole or primary validator, repeated crashes can degrade operational confidence in RPKI deployment and create windows where legitimate route updates cannot be validated, affecting network reliability and potentially impacting upstream and downstream network partners.

Affected systems

NLnet Labs Routinator is affected. The vulnerability applies to instances receiving RRDP updates from untrusted or compromised RPKI repositories. Organizations running Routinator in production for RPKI validation are at risk, particularly those without redundant validator instances or rate-limiting mitigations in place.

Exploitability

This vulnerability is highly exploitable in practical scenarios. It requires only network access to the RRDP endpoint and can be triggered remotely without authentication or user interaction. An attacker with the ability to inject a malicious RRDP document (e.g., via a compromised repository, man-in-the-middle attack, or by controlling a public repository) can crash any Routinator instance that processes the file. No special tooling or advanced capabilities are needed beyond crafting a malicious XML document with a specific DTD pattern.

Remediation

Apply patches released by NLnet Labs to address the DTD handling vulnerability. Immediately update Routinator to a patched version once available. As an interim mitigation, restrict RRDP sources to trusted repositories and implement network-level filtering to reduce exposure to untrusted RRDP endpoints. Consider deploying multiple Routinator instances behind a load balancer to provide resilience against individual crashes. Monitor Routinator logs for unexpected terminations and set up alerting on service restarts.

Patch guidance

Consult the NLnet Labs security advisory and release notes for patched Routinator versions that address this DTD handling issue. Verify the specific version number against the vendor's official security announcement. Test patches in a non-production environment to confirm RRDP functionality and stability before deployment. Plan a maintenance window to deploy patches across all Routinator instances in your RPKI validation infrastructure.

Detection guidance

Monitor Routinator process logs and system logs for unexpected crashes or segmentation faults correlating with RRDP synchronization events. Implement alerting on Routinator service restarts or abnormal terminations. If available, enable verbose logging in Routinator to capture details of malformed RRDP documents received. Network-based detection is challenging without deep packet inspection of RRDP traffic; focus instead on operational monitoring of Routinator availability and graceful recovery procedures.

Why prioritize this

Despite not being on the KEV catalog, this vulnerability merits rapid patching due to its high CVSS score (7.5), lack of authentication requirements, remote exploitability, and direct impact on critical BGP security infrastructure. The ease of exploitation and potential for service disruption in RPKI validation make this a priority for organizations relying on Routinator for route origin validation.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service condition with no authentication barrier and no user interaction required. The vulnerability does not compromise confidentiality or integrity, but its impact on availability is complete—the service becomes unavailable. The lack of complexity in the attack vector and the simplicity of triggering the crash through a malicious RRDP document push this into the HIGH severity band.

Frequently asked questions