LoginSign Up
← Back to all sparks
R

Routinator

INFRA · APIS
Velocity5.0

RPKI relying party software validating BGP route origin authorisations

routinator.docs.nlnetlabs.nl ↗

Routinator 0.16 will validate ASPA and BGPsec, and run strict, by default

rpkiaspabgp-securitynetwork-infrastructurebreaking-changes
◆Current state
Routinator is a mature RPKI validator with a slow, release-candidate-gated cadence. After a run of security work, including an external audit's four CVEs in 0.15.2 and resource-exhaustion fixes in 0.15.3, 0.16.0-rc1 changes defaults: ASPA and BGPsec are on, strict validation is on, and the old enable flags become --disable-aspa, --disable-bgpsec and --relaxed. It also adds Resource Signed Checklists (RFC 9323), SLURM v2 with ASPA filtering, and a new repository logging scheme that changes the /status JSON.
◆Where it's heading
Having spent 2026 hardening the validator, the maintainers are now changing what operators get out of the box. Defaults moving toward ASPA and strictness put newer RPKI object types on equal footing with route origin validation.
◆Prediction
A final 0.16.0 following one or more release candidates is the likely next step, as with 0.15.0.

◆Recent moves

  1. 11d ago

    Routinator 0.16.0-rc1: ASPA, BGPsec and strict mode on by default

    The 0.16 candidate turns on ASPA, BGPsec and strict validation by default and adds RSC and SLURM v2 support, with flag and /status changes operators must handle. A default shift after a year spent on hardening; still a release candidate.

    View source ↗
  2. 14d ago

    Routinator 0.15.3 fixes resource-exhaustion paths

    Routinator 0.15.3 fixes several resource-exhaustion paths, including CRL re-decoding, whole-set buffering of output and recursive drops. Worth deploying for RPKI validators exposed to hostile repositories.

    View source ↗
  3. 5mo ago

    Security audit closes four CVEs in 0.15.2

    An external audit by X41 D-Sec produced four CVEs — a path-traversal in rsync URI handling, two panic conditions, and an XML parsing regression — all fixed here. This is the clearest expression of the trust-engineering turn: the release exists because someone was paid to attack the validator.

    View source ↗
  4. 1y ago

    0.15.1 stops empty-dataset starts and unblocks privileged ports

    Two operator-facing corrections: the optimistic initial run now aborts rather than succeeding with an empty data set, and a systemd PrivateUsers restriction is undone so Routinator can bind privileged ports. Both fit the pattern of removing quiet failure modes.

    View source ↗
  5. 1y ago

    0.15.0 reworks RRDP timeouts and separates repository-issue logs

    The substantive release of this line: a new rrdp-read-timeout config, repository-issue messages moved off the main log and behind an opt-in, and server mode changed to keep running on broken local exception files. It also permanently closes CVE-2023-39916 by removing the rrdp-keep-responses feature outright.

    View source ↗
  6. 1y ago

    0.15.0-rc1 preview of the RRDP timeout rework

    Release candidate whose changelog is a subset of the final 0.15.0 — same breaking changes, same timeout work. No independent signal.

    View source ↗