Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-41531

NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-41531
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 06:51 UTC · Revision 1

Source evidence

CVE-2021-41531

core-osv · Original source

Published 21 Sept 2021, 14:15 UTC

NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation.

osv:CVE-2021-41531
Complete source record
{
  "id": "e3950483c7ecd21b7d3e7c282c70598f1b78caef4e796738fc00b81af9264c79",
  "url": "https://osv.dev/vulnerability/CVE-2021-41531",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-41531",
    "summary": "NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA. This will lead to RTR clients such as routers to reject the RPKI data set, effectively disabling Route Origin Validation.",
    "evidence": "osv:CVE-2021-41531",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-41531",
      "aliases": [
        "CVE-2021-41531"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nlnetlabs/routinator",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2e17fe767bda4d6972ea116c58da542933467a2f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nlnetlabs:routinator:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.10.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.10.0-rc3",
            "v0.10.0-rc2",
            "v0.10.0-rc1",
            "v0.9.0",
            "0.9.0",
            "v0.9.0-rc3",
            "v0.9.0-rc2",
            "v0.9.0-rc1",
            "v0.8.2",
            "v0.8.2-rc1",
            "v0.8.1",
            "v0.8.1-rc1",
            "v0.8.0",
            "v0.8.0-rc2",
            "v0.8.0-rc1",
            "v0.7.1",
            "v0.7.1-rc2",
            "v0.7.1-rc1",
            "v0.7.0",
            "v0.7.0-rc3",
            "v0.7.0-rc2",
            "v0.7.0-rc1",
            "v0.6.4",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.5.0",
            "v0.4.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.1",
            "v0.2.0",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41531.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:45.511754925Z",
      "provider": "osv",
      "references": [
        "https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-41531.txt"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-41531",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 436127,
  "published_at": "2021-09-21T14:15:07.663+00:00"
}