CVE-2019-13955: MikroTik RouterOS

Medium severity, CVSS 6.5. EPSS: 3.8% chance of exploitation in the next 30 days.

Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected.

Affected products

• MikroTik RouterOS: before 6.44.5 (fixed in 6.44.5); version 6.45 only

Published 2019-07-26. Last modified 2026-06-17.