Live › vulnerability › CVE-2026-72752
Go to dashboardRoutinator, an RPKI validator, runs out of memory when many concurrent requests for its JSON output arrive, and it can crash with a stack overflow when a payload item carrying too much metadata is discarded. An attacker who can open many connections to the HTTP server can exhaust memory and take the service down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Only deployments that expose Routinator's HTTP or RTR server to untrusted networks are affected, because the attack relies on opening many connections to that server. Routinator instances that serve only trusted networks or run without a network-facing server can skip it.
No product ranges from the sources yet.
routinator server --http settings or firewall rules, since the sources say only those deployments are affectedroutinator --version and compare it with the fixed release, which the sources do not nameEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once.
This only affects users that make their HTTP or RTR server available to untrusted networks.
This page as .md · .json · in your agent: get_signal("CVE-2026-72752")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.