The vulnerability causes Routinator, the BGP route validation software, to terminate when it receives an rsync URI containing a path that cannot be stored on the host filesystem. Because the process exits, encryption checks for inbound route announcements stop, creating a denial of service that can affect the availability of route validation for the affected network operator. The flaw is a result of improper handling of file system paths, identified as CWE-755.

The issue is present in all versions of NLnet Labs Routinator before 0.15.3. Any deployment of the older software that relies on RRDP to download routing data is potentially vulnerable.

The CVSS score is 7.5, indicating a high severity of the denial of service. No EPSS value is reported, and it is not included in CISA KEV. An attacker who can influence the RRDP feed sent to a vulnerable Routinator instance would trigger the bug by providing an rsync URI with an overly long filename or a name that conflicts with an existing file, leading to a process crash. Because the trigger is a malformed URI, the attack vector is remote and only requires control over the source of RRDP updates.