GitHub Advisoryadvisory · crates.io

GHSA-5qf9-cf9c-hjc6 Routinator crashes when encountering maliciously crafted RRDP XML files

HIGH Published 2026-06-08 Modified 2026-06-12 Official page ↗
Aliases
CVE-2026-49235
Ecosystem
crates.io
Packages
routinator
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Weaknesses
CWE-400, CWE-755, CWE-776
Reviewed
2026-06-12

Affected packages

• crates.io routinator: < 0.15.2 → fixed in 0.15.2

Description

When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.

Related

Alias · CVE (1)

  • CVE-2026-49235 When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes. vulnerability

Weakness · CWE (3)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References