Routinator, a software distribution for routing policies, contains a flaw in the AS range parsing logic. When an AS range definition has a maximum value that is smaller than its minimum value, the parser never reaches the end of the range and continues to allocate memory until the process runs out. This memory exhaustion causes the program to terminate. The issue is classified as CWE‑755, improper handling of malformed input.

All versions of NLnet Labs' Routinator prior to 0.15.3 are affected. The vendor has fixed the bug in 0.15.3 and all later releases, so users of earlier releases should update to mitigate the vulnerability.

The CVSS score of 7.5 indicates a high impact, and the EPSS score is not available, which does not inform the current likelihood of exploitation. It is not listed in the CISA known exploited vulnerabilities catalog. Based on the description, the vulnerability is triggered by parsing malformed AS ranges, which may be supplied through configuration files or external data feeds that Routinator ingests. Therefore an attacker who can influence those inputs could trigger the out-of-memory crash to cause a denial of service. The exploit does not require additional system privileges and can be realized by feeding a crafted range.