NLnet Labs Routinator Denial-of-Service Vulnerability via Connection Flooding

A denial-of-service vulnerability has been identified in NLnet Labs Routinator versions prior to and including 0.15.1. The issue arises because Routinator exits upon encountering any error while handling incoming HTTP or RTR connections. This includes recoverable errors, such as depleting available file descriptors. An attacker can exploit this vulnerability by opening a large number of connections to the HTTP or RTR server, causing Routinator to crash. This issue only affects users who expose their HTTP or RTR server to untrusted networks.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing Routinator to exit unexpectedly and disrupt service.

Remediation

Users are advised to upgrade to Routinator version 0.15.2 or later.