Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected.
| Software | From | Fixed in |
|---|---|---|
| mikrotik / routeros | - | 6.44.5 |
| mikrotik / routeros | 6.45 | 6.45.x |