CVE-2024-1622 is a high severity (CVSS 7.5) denial of service flaw in NLnet Labs Routinator, an RPKI relying party. Due to an error checking mistake, Routinator terminates when an incoming RTR connection is reset by the peer too quickly after opening. The fix is Routinator 0.13.2 or later.
What's affected
NLnet Labs lists Routinator up to and including 0.13.1 as affected, and says 0.13.2 handles such connections correctly. The advisory's solution is to install 0.13.2 or later.
The NVD record also lists Fedora 38, 39 and 40 in its configuration data, because those distributions package Routinator and published update announcements. The score is 7.5 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so there is no confidentiality or integrity impact. The listed weakness classes are CWE-253 (incorrect check of function return value) and CWE-754 (improper check for unusual or exceptional conditions).
How to check if you're exposed
Check the version on each host that runs the RTR service.
routinator --version
If you installed from a Fedora package, check the package version and the distribution's update announcement, which the record references. If you run Routinator in a container, check the image tag. Any value at or below 0.13.1 is affected. The exposure that matters is the RTR port. If it is reachable from networks you do not control, an unauthenticated peer can trigger the crash.
What to do now
- Upgrade Routinator to 0.13.2 or later, or install your distribution's patched package.
- Restart the service and confirm the new version with the version command.
- Limit who can reach the RTR port with firewall rules, as a general measure.
- Make sure your supervisor (systemd or an orchestrator) restarts the service on exit, and alert on repeated restarts.
- Check that your routers have a fallback validator while you patch.
Why it matters
Routinator feeds route validation data to routers. If it stops, routers lose a source of RPKI data, so a crash is more than an annoyance for network operators. The cause here is plain: an error from a connection reset was not handled and the process ended instead of dropping that one connection.
This is a common class of bug. Code that reads from a socket must treat a reset as normal, because peers go away at any moment. The advisory credits researchers at Internet Multifeed Co., Japan. The record does not flag the issue as exploited. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
What is the fixed version?
NLnet Labs says Routinator 0.13.2 or later. Versions up to and including 0.13.1 are affected.
Sources
Last reviewed: 19 October 2026.
