CVE-2019-13954: Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion.

Security readout for executives and security teams

This issue affects MikroTik RouterOS long-term releases before 6.44.5. An authenticated remote user can send a crafted HTTP request that exhausts memory, crashing the HTTP server and sometimes rebooting the device. The sources state malicious code cannot be injected, so the main business risk is service disruption, not takeover. Exposure is most likely on MikroTik RouterOS devices running the long-term release tree before 6.44.5 where the HTTP service is reachable by authenticated users. The source bundle does not identify specific device models, configurations, or CPEs. Treat this as a moderate availability risk for affected MikroTik infrastructure. Prioritize internet-reachable or broadly reachable management surfaces, then internal-only devices. The issue is not described as code execution, but device reboot can still disrupt network operations. Mitigation focus: Inventory MikroTik RouterOS devices and identify long-term releases before 6.44.5.; Upgrade affected long-term RouterOS systems to 6.44.5 or later where supported.; Restrict HTTP service reachability to trusted administrative networks..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.