Routinator may terminate or become unresponsive when it processes a CRL file that contains an unusually large number of entries or is encoded incorrectly. The issue is an improper handling of exceptional conditions (CWE-755) and can lead to resource exhaustion or abrupt termination, effectively denying the service that relies on Routinator. No evidence indicates arbitrary code execution or privilege escalation.

NLnet Labs Routinator versions earlier than 0.15.3 are impacted. No other NLnet Labs products are affected.

With a CVSS score of 7.5, this vulnerability is high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. Exploitation would require an attacker to provide a large or malformed CRL file to Routinator, which could be achieved by compromising a source of CRLs or manipulating the configuration that specifies CRL locations. The attack vector is likely local or remote at the network level, depending on how Routinator retrieves CRLs; an exploited scenario could cause a denial‑of‑service crash, disrupting routing validation services.