Routinator, the RRDP client used by NLnet Labs, suffers from a denial‑of‑service flaw when it processes a specially crafted document type definition within an RRDP XML stream. The vulnerability, classified as CWE‑755 (Uncontrolled Resource Consumption), causes the program to crash, disrupting downstream operations that rely on RRDP data.

The affected product is NLnet Labs Routinator, any release older than version 0.15.2. Version 0.15.2 and later contain the upstream fix that prevents crashes on malformed DTDs.

The CVSS score of 8.7 indicates a high severity risk. No EPSS value is reported and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker feeding the vulnerable RRDP client a crafted XML file via the RRDP protocol, leading to a crash that interrupts the service. The absence of an exploit probability metric suggests the likelihood is not precisely measured, but the high CVSS score signals significant risk if not mitigated.