CVE-2022-3029 Fatal error on incorrect base64 data in RRDP

What is CVE-2022-3029?

CVE-2022-3029 is a high-severity denial of service vulnerability in NLnet Labs Routinator, published on 13 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may stop your network from validating route origins based on RPKI data. This vulnerability does not allow an attacker to manipulate RPKI data.

Weakness: CWE-241

Which versions are affected by CVE-2022-3029?

2 open source packages ship an affected version, including routinator. It affects 1 product.

Products include Nlnetlabs Routinator.

How do I fix CVE-2022-3029?

Upgrade routinator to 0.11.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-3029 being exploited?

There is no known exploitation of CVE-2022-3029 in the wild and no public exploit code.

Other vulnerabilities in NLnet Labs Routinator

• CVE-2023-39916 Possible path traversal when storing RRDP responses Critical 9.3
• CVE-2026-49235 Routinator crashes on specifically crafted RRDP XML files High 8.7
• CVE-2026-49233 Routinator cache path traversal using rogue rsync URIs High 8.3
• CVE-2026-49234 Routinator crashes on specifically crafted ASN strings in the API High 8.2
• CVE-2023-39915 Crashes on parsing certain invalid RPKI objects High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m4vx-ccrf-w399.