CVE-2025-0638CWE-1286

Routinator crashes when illegal characters are present in manifest file names

High · published January 22, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00476 · 40.1th percentile
Weakness
CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published
2025-01-22T15:48Z
EPSS history
Timeline
  • 22 JAN 15:48Z
    Routinator crashes when illegal characters are present in manifest file names
    cvelistv5