8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49235

CVE-2026-49235: Routinator crashes when encountering maliciously crafted RRDP XML files

When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49235

CVE-2026-49235:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
routinator	rust	<= 0.15.1	0.15.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a transitive dependency, quick-xml, which is used by the rpki crate for parsing RRDP XML files. Routinator uses the rpki crate to handle RPKI repository updates. The vulnerability is a denial-of-service caused by a crash when parsing a maliciously crafted XML file with a specially designed Document Type Definition (DTD), likely causing uncontrolled resource consumption or a panic due to an issue like entity expansion.

The patch for this vulnerability in Routinator does not involve any direct code changes in its own source files. Instead, the fix was to upgrade the rpki dependency from version 0.19.0 to 0.19.3 in Cargo.toml. This new version of rpki includes an updated version of quick-xml where the XML parsing vulnerability is fixed.

The identified vulnerable functions are the entry points in the Routinator codebase that initiate the RPKI data processing and repository updates. When Routinator is run, either as a one-off command or as a server, these functions are on the call stack that ultimately triggers the vulnerable XML parsing logic within the rpki crate. An attacker could exploit this by hosting a malicious RRDP repository. When Routinator attempts to sync with this repository, it would fetch and parse the malicious XML file, leading to a crash.

Vulnerable functions

process::Process::run

src/process.rs

This function is the main entry point for processing RPKI data. It iterates through the configured Trust Anchor Locators (TALs) and initiates the validation process for each. This process includes updating the local cache of the repositories, which for RRDP repositories involves parsing XML files. A maliciously crafted XML file could cause a crash, making this function a key part of the vulnerable execution path.

tal::Tal::process

src/tal.rs

This function is called by `process::Process::run` for each Trust Anchor Locator. It is responsible for processing a single TAL, which involves fetching and validating the repository data. It uses the `rpki::repository::Repository` to perform the update, which in turn calls the vulnerable XML parsing code when dealing with an RRDP repository. Therefore, this function is directly in the call chain that triggers the vulnerability.

server::Server::run

src/server.rs

When Routinator runs in server mode, this function is the main entry point. It spawns a task that periodically updates the RPKI cache by calling `server::update_cache`. Since this leads to the execution of the vulnerable RRDP update logic, this function is part of the vulnerable execution path in server mode.

server::update_cache

src/server.rs

This function is called periodically by `server::Server::run` to keep the RPKI cache up-to-date. It does so by calling `process::Process::run`, which triggers the repository update process. This makes it a key function in the call chain leading to the vulnerable XML parsing code when Routinator is running as a server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.