Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. routinator
  4. ›
  5. CVE-2021-43174

CVE-2021-43174: Memory exhaustion in routinator

November 11, 2021 (updated November 15, 2021)

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.

References

  • github.com/NLnetLabs/routinator
  • github.com/advisories/GHSA-6mv9-qcx2-3hh3
  • nvd.nist.gov/vuln/detail/CVE-2021-43174
  • www.debian.org/security/2022/dsa-5041
  • www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt

Code Behaviors & Features

Detect and mitigate CVE-2021-43174 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.9.0 before 0.10.2

Fixed versions

  • 0.10.2

Solution

Upgrade to version 0.10.2 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-787: Out-of-bounds Write

Source file

cargo/routinator/CVE-2021-43174.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:25 +0000.