https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-56375.htmlhttps://patchthecve.com/cve/CVE-2024-56375.htmlWed, 17 Jun 2026 08:12:08 +0000HIGH 7.5: An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array durinhttps://patchthecve.com/cve/CVE-2024-56170.htmlhttps://patchthecve.com/cve/CVE-2024-56170.htmlWed, 17 Jun 2026 08:11:46 +0000MEDIUM 5.3: A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to verify. Assuming everything else is correct, the most recent version of a manifest should be prioritized over other versions, to prevent replays,https://patchthecve.com/cve/CVE-2024-56169.htmlhttps://patchthecve.com/cve/CVE-2024-56169.htmlWed, 17 Jun 2026 08:11:46 +0000MEDIUM 5.3: A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain a backup cache of the remote RPKI data. This can be employed as a fallback in case a new fetch fails or yields incorrect files. However, the product currently https://patchthecve.com/cve/CVE-2024-45239.htmlhttps://patchthecve.com/cve/CVE-2024-45239.htmlWed, 17 Jun 2026 07:53:50 +0000HIGH 7.5: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a null eContent field. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party,https://patchthecve.com/cve/CVE-2024-45238.htmlhttps://patchthecve.com/cve/CVE-2024-45238.htmlWed, 17 Jun 2026 07:53:50 +0000HIGH 7.5: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsihttps://patchthecve.com/cve/CVE-2024-45237.htmlhttps://patchthecve.com/cve/CVE-2024-45237.htmlWed, 17 Jun 2026 07:53:49 +0000CRITICAL 9.8: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without prhttps://patchthecve.com/cve/CVE-2024-45236.htmlhttps://patchthecve.com/cve/CVE-2024-45236.htmlWed, 17 Jun 2026 07:53:49 +0000HIGH 7.5: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relyinhttps://patchthecve.com/cve/CVE-2024-45235.htmlhttps://patchthecve.com/cve/CVE-2024-45235.htmlWed, 17 Jun 2026 07:53:49 +0000HIGH 7.5: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizhttps://patchthecve.com/cve/CVE-2024-45234.htmlhttps://patchthecve.com/cve/CVE-2024-45234.htmlWed, 17 Jun 2026 07:53:49 +0000HIGH 7.5: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics