Seven Years of Development: External Audit Gives Routinator a Clean Bill of Health

Routinator, an open-source software tool that helps secure the Internet's routing system, has just completed a security audit that confirms its maturity after seven years in the field. The audit was performed by X41 D-Sec, an independent security firm, and commissioned by the Sovereign Tech Agency under their Sovereign Tech Resilience programme. The verdict: Routinator is on a good security level and uses the Rust programming language's safety features well. The findings were all addressed in the newest version, Routinator v0.15.2, released on June 8, 2026.

To understand why this matters, we need to look at what Routinator does. The Internet relies on a protocol called BGP (Border Gateway Protocol) to route traffic between networks. However, BGP was originally designed without strong security measures, making it vulnerable to attacks such as route hijacking, where an attacker announces an IP address range they don't actually own, redirecting or intercepting traffic. RPKI (Resource Public Key Infrastructure) solves this by using digital signatures to verify that an announcement comes from the legitimate owner. Routinator is an RPKI relying party client: it fetches RPKI data and performs ROV (Route Origin Validation) to ensure that only valid announcements are accepted. As of July 2026, more than 5000 RPKI relying party clients are fetching this data globally, and over 4000 of them are using Routinator. This means a significant part of the Internet depends on Routinator working correctly.

Given the critical nature of the software, NLnet Labs has always focused on resilience. They recently published a threat model that outlines the promises Routinator makes, under certain assumptions like the host system not being already compromised. But they didn't want to rely only on their own efforts. So when the opportunity arose from the Sovereign Tech Agency to have Routinator audited, they applied. X41 D-Sec then 'put Routinator through the wringer,' as the team puts it.

The audit's overall conclusion is reassuring. In the words of X41 D-Sec: "the system appears to be on a good security level and uses Rust's safety features well. The audit showed that the source code follows the protocol definitions closely, and appropriately establishes trust by verifying signatures before updating data in the local state." However, it also found that the main weaknesses were related to denial-of-service (DoS) vectors and availability, areas that can be difficult to keep in mind during development.

X41 D-Sec discovered six distinct issues, all of which have been remediated in Routinator v0.15.2. There were also eight other findings that the NLnet Labs team chose to fix proactively, even though they weren't exploitable at the time. The six issues can be grouped into four categories. The first involves the HTTP/RTR server being too quick to quit Routinator on errors, including ones that could have been recovered from. This allowed an attacker to cause a denial of service (CVE-2026-49232). The second category relates to RPKI objects potentially writing to parts of the cache they should not influence (CVE-2026-49233). Third, a parsing error in handling AS numbers could crash Routinator when malformed UTF-8 input is sent through the API (CVE-2026-49234). Fourth, a flaw in the XML parser dependency called quick-xml caused crashes when specially crafted XML documents were parsed (CVE-2026-49235). The team was happy to give back to the community by fixing this issue in the dependency itself.

The main lesson from the audit, according to NLnet Labs, is to be even more vigilant when parsing input data. While they had already worked to reject invalid data, they had not focused enough on 'technically-valid-but-unreasonable' data. Such data, for instance, could cause Routinator to crawl to a standstill or crash due to memory exhaustion. This is especially dangerous if the data is cached, because it would be parsed again on restart, repeatedly causing the same problem. They will continue to harden the software against this kind of attack in the future.

The full audit report has been shared publicly by NLnet Labs, allowing anyone to review the details. They thank both the Sovereign Tech Agency for commissioning the audit and X41 D-Sec for conducting it, noting that together they made the Internet more resilient.

Now comes a crucial reminder: these fixes only protect you if you update to the latest version, Routinator v0.15.2. The NLnet Labs team notes that many instances are still several versions behind, leaving them exposed to known vulnerabilities. If you run Routinator, the call to action is simple: go and update.

Although this story focuses on routing security, it ties into the broader theme of protecting your digital life. Just as Routinator helps keep the Internet's routes secure, a private, encrypted DNS service like AEU DNS helps keep your browsing safe from tampering and surveillance. AEU DNS is a European, privacy-first resolver that supports DNS over HTTPS and other encrypted protocols, ensuring that your online requests stay confidential and protected from DNS-level attacks. By choosing such a service, you add another layer of defense against cyber threats.