CVE-2021-43174

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support
the gzip transfer encoding when querying RRDP repositories. This encoding
can be used by an RRDP repository to cause an out-of-memory crash in these
versions of Routinator. RRDP uses XML which allows arbitrary amounts of
white space in the encoded data. The gzip scheme compresses such white
space extremely well, leading to very small compressed files that become
huge when being decompressed for further processing, big enough that
Routinator runs out of memory when parsing input data waiting for the next
XML element.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929024&gt;