CVE-2026-49235: Routinator DOS Vulnerability via RRDP

CVE-2026-49235 Overview

CVE-2026-49235 is a denial-of-service vulnerability in NLnet Labs Routinator, a Resource Public Key Infrastructure (RPKI) Relying Party software. The flaw allows a remote attacker to crash Routinator by serving a file via the RPKI Repository Delta Protocol (RRDP) that contains a specifically crafted Document Type Definition (DTD). The vulnerability is classified under [CWE-755] (Improper Handling of Exceptional Conditions). Routinator is widely deployed by network operators to validate Border Gateway Protocol (BGP) route announcements, and a crash disrupts route origin validation across the affected network.

Critical Impact
A network-adjacent attacker controlling or impersonating an RRDP repository can trigger a Routinator process crash, disrupting RPKI validation and BGP route origin verification for the affected operator.

Affected Products

NLnet Labs Routinator (versions affected as listed in the vendor advisory)
Deployments consuming RPKI data via RRDP
Network operators relying on Routinator for BGP route origin validation

Discovery Timeline

2026-06-08 - CVE-2026-49235 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49235

Vulnerability Analysis

The vulnerability resides in how Routinator parses XML content retrieved from RRDP repositories. RRDP transports RPKI repository data as XML documents. When the parser encounters a file containing a specifically crafted Document Type Definition, Routinator fails to handle the exceptional condition and the process terminates. The result is loss of RPKI validation services until the process is restarted.

Because the attack vector is network-based and requires no authentication or user interaction, any attacker that can deliver a malicious XML payload through an RRDP source can trigger the crash. The impact is confined to availability; confidentiality and integrity of Routinator data are not directly affected.

Root Cause

The root cause is improper handling of exceptional conditions during XML parsing of RRDP responses, specifically when DTD constructs are present. Rather than rejecting or safely ignoring the malformed or unexpected DTD, the parsing path propagates an error that aborts the Routinator process. This maps to [CWE-755], where the application fails to gracefully handle an exceptional input condition.

Attack Vector

Exploitation requires the attacker to influence the content returned from an RRDP endpoint that Routinator queries. This can be achieved by operating a malicious RRDP repository, compromising an upstream repository, or performing a network-position attack against unauthenticated transport. Once Routinator fetches the crafted file during normal RRDP polling, the parser processes the embedded DTD and the process crashes.

No verified public proof-of-concept code is available. See the NLnet Labs CVE-2026-49235 Advisory for vendor technical details.

Detection Methods for CVE-2026-49235

Indicators of Compromise

Unexpected termination of the Routinator process during or shortly after RRDP fetch cycles
RRDP responses containing <!DOCTYPE declarations or inline DTD content, which are not expected in standard RPKI delta or snapshot XML
Repeated process restarts logged by the service manager correlated with specific RRDP source URLs

Detection Strategies

Inspect RRDP HTTP responses at the network egress for XML payloads containing DTD declarations and alert on their presence
Monitor Routinator logs for parser errors, abnormal exits, and validation gaps in the RPKI cache
Correlate process crash events with the last fetched RRDP URL to identify the offending repository source

Monitoring Recommendations

Track Routinator uptime and RTR session continuity to downstream routers as a health signal
Alert on increased frequency of full RPKI cache rebuilds, which can indicate repeated crashes
Forward Routinator stdout, stderr, and systemd journal entries to a central log platform for retention and search

How to Mitigate CVE-2026-49235

Immediate Actions Required

Upgrade Routinator to the fixed version identified in the NLnet Labs CVE-2026-49235 Advisory
Restrict configured RRDP sources to trusted Trust Anchor Locator (TAL) publishers and verified repository operators
Ensure Routinator runs under a service supervisor that restarts the process on crash to preserve RTR availability while patching

Patch Information

NLnet Labs has published a security advisory for CVE-2026-49235. Operators should consult the NLnet Labs CVE-2026-49235 Advisory for the specific fixed release version and upgrade instructions. Apply the vendor-supplied patched build to all Routinator instances before relaxing any compensating controls.

Workarounds

Temporarily fall back to rsync transport for repositories that support it, bypassing the RRDP parsing path until the patch is applied
Place RRDP fetches behind an HTTP proxy that strips or rejects XML responses containing DTD declarations
Deploy redundant Routinator instances behind a load balancer so that a single crashed instance does not interrupt RTR feeds to routers

bash

# Configuration example: verify installed version and restart service after upgrade
routinator --version
systemctl restart routinator
systemctl status routinator