CVE-2026-53499

Name	CVE-2026-53499
Description	FORT Validator is a Resource Public Key Infrastructure (RPKI) relying-party validator that produces validated route-origin data. FORT Validator versions through 1.6.7 contain an origin-validation error in their RRDP processing: a delegated CA under the same Trust Anchor Locator (TAL) can reference a victim CA’s public RRDP notification and snapshot URLs, causing FORT’s URL-based download cache to report success after deleting the victim’s local snapshot. Following a routine victim publication, this can silently remove the victim’s VRPs and other signed objects from FORT’s output, potentially enabling route hijacking or loss of reachability. Version 1.6.8 contains a patch that rejects cross-origin RRDP snapshot and delta URLs; as a workaround, administrators can disable HTTP/RRDP with --http.enabled=false while keeping rsync enabled, although this can leave data unavailable or stale where rsync is not supported.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6490-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fort-validator (PTS)	bookworm	1.5.4-1+deb12u1	vulnerable
	trixie	1.6.6-1	vulnerable
	trixie (security)	1.6.8-0+deb13u1	fixed
	forky, sid	1.7.0.experimental-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fort-validator	source	trixie	1.6.8-0+deb13u1		DSA-6490-1
fort-validator	source	(unstable)	1.6.8-1

Notes

https://github.com/NICMx/FORT-validator/security/advisories/GHSA-qfm3-577x-rh54
Fixed by: https://github.com/NICMx/FORT-validator/commit/284023585ea74d64175c5e25ec674a563aa9e81c (1.6.8)
Fixed by: https://github.com/NICMx/FORT-validator/commit/e6b953cec420bd6fa10ada8e9727edae64521e16 (1.6.8)