Routinator parses RRDP notification files without adequately validating that delta entries contain continuous sequence identifiers; gaps in these entries are still accepted, which allows an attacker to inject malformed updates that cause legitimate routing data to be omitted. The vulnerability can also cause a memory exhaustion condition when an excessive number of delta entries are processed, leading to application crashes or prolonged unavailability. The associated weakness is identified as CWE‑755.

The vulnerable component is the Routinator application distributed by NLnet Labs. Versions of Routinator released prior to 0.15.3 are affected, as the fix was introduced in that release. All later releases have the issue resolved.

The CVSS score of 8.2 indicates a high severity for the combination of confidentiality, integrity, and availability impacts. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable via the RRDP protocol, which is normally received from external routing peers; therefore a remote attacker who can influence the RRDP feed can supply crafted delta files and trigger the denial‑of‑service condition or data loss. No requirement for privileged access or user interaction is stated, so the likely attack vector is remote network.