{"cve":"CVE-2023-0158","nvd":{"published":"2023-01-17T17:15:11.837","modified":"2026-06-17T05:24:55.367","status":"Modified","description":"NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the \"/rrdp\" endpoint. Prior to 0.12.1 a direct query for any existing directory under \"/rrdp/\", rather than an RRDP file such as \"/rrdp/notification.xml\" as would be expected, causes Krill to crash. If the built-in \"/rrdp\" endpoint is exposed directly to the internet, then malicious remote parties can cause the publication server to crash. The repository content is not affected by this, but the availability of the server and repository can cause issues if this attack is persistent and is not mitigated.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-248"],"references":["https://www.nlnetlabs.nl/downloads/krill/CVE-2023-0158.txt","https://www.nlnetlabs.nl/downloads/krill/CVE-2023-0158.txt"],"products":["nlnetlabs:krill"],"source":"nvd","synced_at":"2026-10-19T21:37:34.931465858+00:00"},"epss":{"cve":"CVE-2023-0158","score":0.00721,"percentile":0.53979,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}