CVE-2025-0638: Routinator crashes when illegal characters are present in manifest file names

Published Jan 22, 2025

Updated

The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator.

Affected Software

1 affected component

Nlnet Labs Routinator

Remediation

Information

This issue is fixed in 0.14.1 and all later versions.

Event History

Jan 22, 2025

CVE Published

via MITRE·03:48 PM

Data Sourced

via MITRE·03:48 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0638?

CVE-2025-0638 is classified as a moderate severity vulnerability due to its potential to cause a crash of the Routinator software.

How do I fix CVE-2025-0638?

To fix CVE-2025-0638, ensure that you are using the latest version of NLnet Labs Routinator, which addresses the manifest file checking issue.

What impact does CVE-2025-0638 have on Routinator?

CVE-2025-0638 can lead to a crash in Routinator when it encounters illegal characters in file names, impacting the stability of the software.

Is there a workaround for CVE-2025-0638?

Currently, the best approach for CVE-2025-0638 is to upgrade to the patched version of Routinator as no direct workarounds are available.

Who is affected by CVE-2025-0638?

CVE-2025-0638 affects all users of NLnet Labs Routinator using versions prior to the release that mitigates this vulnerability.