{"id":"CVE-2025-0638","state":"PUBLISHED","title":"Routinator crashes when illegal characters are present in manifest file names","description":"The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator.","publishedAt":"2025-01-22T15:48:44.796Z","updatedAt":"2025-02-12T20:41:23.525Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"NLnet Labs"},"assigner":"NLnet Labs","products":["NLnet Labs Routinator"],"affected":[{"vendor":"NLnet Labs","product":"Routinator","defaultStatus":"affected","versions":[{"version":"0.14.1","status":"unaffected","lessThan":"*","versionType":"semver"}]}],"references":["https://www.nlnetlabs.nl/downloads/routinator/CVE-2025-0638.txt"],"weaknesses":["CWE-1286"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/0xxx/CVE-2025-0638.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-0638","state":"PUBLISHED","datePublished":"2025-01-22T15:48:44.796Z","dateUpdated":"2025-02-12T20:41:23.525Z","assignerShortName":"NLnet Labs","assignerOrgId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","dateReserved":"2025-01-22T11:07:17.929Z"},"containers":{"cna":{"title":"Routinator crashes when illegal characters are present in manifest file names","descriptions":[{"lang":"en","value":"The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator."}],"affected":[{"vendor":"NLnet Labs","product":"Routinator","defaultStatus":"affected","versions":[{"version":"0.14.1","status":"unaffected","lessThan":"*","versionType":"semver"}]}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2025-0638.txt","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1286","lang":"en","description":"CWE-1286: Improper Validation of Syntactic Correctness of Input","type":"CWE"}]}],"providerMetadata":{"shortName":"NLnet Labs","orgId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","dateUpdated":"2025-01-22T15:48:44.796Z"},"datePublic":"2025-01-22T00:00:00.000Z","solutions":[{"lang":"en","value":"This issue is fixed in 0.14.1 and all later versions."}],"timeline":[{"time":"2024-12-20T00:00:00.000Z","lang":"en","value":"Issue reported"},{"time":"2025-01-22T00:00:00.000Z","lang":"en","value":"Fixes released"}],"credits":[{"lang":"en","value":"Haya Schulmann, Niklas Vogel; Goethe University Frankfurt/ATHENE Center","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-0638","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-01-22T16:15:35.504737Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-12T20:41:23.525Z"}}]}}}