gzip transfer encoding caused out-of-memory crash

Vulnerability

NLnet Labs Routinator versions 0.9.0 through 0.10.1 support gzip transfer encoding when querying RRDP repositories. RRDP uses XML, which allows arbitrary amounts of whitespace in the encoded data. The gzip compression scheme compresses such whitespace extremely well, resulting in very small compressed files that decompress into extremely large XML documents. Routinator runs out of memory when parsing this inflated input data while waiting for the next XML element, leading to a crash [1][2].

Exploitation

An attacker controlling an RRDP repository can serve a small gzip-compressed XML file containing massive whitespace. When Routinator (versions 0.9.0 through 0.10.1) fetches and decompresses this resource, the resulting expanded XML exhausts available memory during parsing. No special network position or authentication is required beyond the ability to act as an RRDP repository that the victim instance queries [1][2].

Impact

Successful exploitation causes an out-of-memory crash of the Routinator process. This denial-of-service condition prevents the RPKI validator from completing its validation run, leading to continued serving of stale RPKI data or, if the crash occurs during initial startup, no data being served at all [1][2].

Mitigation

Routinator version 0.10.2 fixes this vulnerability by removing support for gzip transfer encoding in RRDP requests. Users should upgrade to 0.10.2 or later. There is no known workaround for unpatched versions. The vulnerability was disclosed on 2021-11-09 and is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [2][3].