# CVE-2021-43173: cfrpki: In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not...

CVE-2021-43173 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2021-43173, released November 9, 2021. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-43173
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0140
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 9, 2021

## Description

In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cfrpki Debian 12.15 (bookworm) | 1.4.0-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |
| Linux | fort-validator Debian 12.15 (bookworm) | 1.5.3-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |
| Linux | fort-validator Debian 13.5 (trixie) | 1.5.3-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |
| Linux | fort-validator Debian 14 | 1.5.3-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |
| Linux | rpki-client Debian 12.15 (bookworm) | 7.5-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |
| Linux | rpki-client Debian 13.5 (trixie) | 7.5-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |
| Linux | rpki-client Debian 14 | 7.5-1 | [DEBIAN-CVE-2021-43173](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43173.md) | Nov 9, 2021 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.