Xin Wang

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.

A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the `serve-expired: yes` setting is enabled alongside a `response-ip: <net> redirect` or `response-ip-data: <net> CNAME <target>` rule, or the equivalent `rpz-cname-override`. The issue stems from the `serve-expired-client-timeout()` function, which executes a two-pass loop to follow a CNAME alias generated by response-ip. During the second pass, the function resets the `alias rrset` variable but fails to reset `partial rep`, resulting in a NULL pointer dereference. An attacker can trigger this by controlling a zone that returns an A/AAAA record within the configured response-ip/rpz subnet and delaying the response after the previous record has expired.

An issue exists when the software is configured with `serve-expired: yes` and `serve-expired-client-timeout` is greater than `discard-timeout` (where `discard-timeout` is greater than 0). In this specific configuration, the `discard-timeout` branch within the serve expired logic drops an aged client reply without correctly decrementing the counter for the number of reply addresses for the query. Because the counter is not decremented, it can reach its maximum limit, causing new clients for duplicate in-flight queries to be silently dropped, which leads to a degradation of the resolution service. A malicious actor can trigger this by querying the resolver for a client-controlled slow-on-demand authoritative zone to push the counter past the threshold.