Routinator can exhaust memory when an attacker repeatedly requests the JSON output, causing the process to crash. In addition, a stack overflow occurs if a payload item containing excessive metadata is discarded simultaneously. Both conditions result in an abrupt termination of the service, preventing legitimate clients from accessing valid routing information.

The vulnerability affects installations of NLnet Labs Routinator. Any instance that exposes its HTTP or RTR HTTP server to untrusted networks is susceptible. No specific version range is given other than the fix being available in 0.15.3 and later, so users on earlier releases must adjust.

The CVSS score of 6.5 indicates a moderate impact and potential for disruption. EPSS data is unavailable, but the problem can be triggered by a high volume of concurrent connections, which is realistic for attackers targeting exposed services. The vulnerability is not listed in CISA’s KEV catalog, yet it remains a legitimate threat for any publicly accessible Routinator instance.