CVE-2020-16163: Ripe Rpki Validator 3

Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days.

An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint. This allows remote attackers to bypass intended access restrictions, or to trigger denial of service to traffic directed to co-dependent routing systems. NOTE: third parties assert that the behavior is intentionally permitted by RFC 8182

Affected products

• Ripe Rpki Validator 3: from 3.0, up to and including 3.1-2020.07.06.14.28

Published 2020-07-30. Last modified 2026-06-17.