Advisories · Technology
NLnet Labs Krill.
Every CVE that names NLnet Labs Krill among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.4 High
Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
- NLnet Labs Krill
- Broken access control
- CVSS 8.4 High
Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
- NLnet Labs Krill
- Broken access control
- CVSS 8.4 High
Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token
- NLnet Labs Krill
- CWE-323
- CVSS 7.5 High
Triggered crash on direct RRDP access
- NLnet Labs Krill
- CWE-248