{"id":"CVE-2026-72752","kind":"vulnerability","aliases":["CVE-2026-72752"],"related":[],"title":"Routinator: concurrent JSON requests exhaust memory and crash the process","description":"Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once.\n\nThis only affects users that make their HTTP or RTR server available to untrusted networks.","summary":"Routinator, an RPKI validator, runs out of memory when many concurrent requests for its JSON output arrive, and it can crash with a stack overflow when a payload item carrying too much metadata is discarded. An attacker who can open many connections to the HTTP server can exhaust memory and take the service down.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","routinator","rpki","self-hosted"],"not_affected_if":["internal-only-network","no-http-or-rtr-server"],"how_to_check":"- Check whether the HTTP or RTR server is reachable from untrusted networks, for example with `routinator server --http` settings or firewall rules, since the sources say only those deployments are affected\n- Confirm the installed version with `routinator --version` and compare it with the fixed release, which the sources do not name","fix":"- Upgrade Routinator to a release that includes the fix for CVE-2026-72752; the fixed version is unknown from the sources\n- Until upgraded, restrict access to the HTTP and RTR servers to trusted networks","status":"open","published_at":"2026-10-26T18:18:40+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:55+00:00","updated_at":"2026-10-26T18:33:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:33:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Routinator to a release that includes the fix for CVE-2026-72752; the fixed version is unknown from the sources\n- Until upgraded, restrict access to the HTTP and RTR servers to trusted networks","reach":"internet","title":"Routinator: concurrent JSON requests exhaust memory and crash the process","impact":"medium","summary":"Routinator, an RPKI validator, runs out of memory when many concurrent requests for its JSON output arrive, and it can crash with a stack overflow when a payload item carrying too much metadata is discarded. An attacker who can open many connections to the HTTP server can exhaust memory and take the service down.","category":"package","nicknames":[],"who_cares":["routinator","rpki","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Service crashes or runs out of memory, causing denial of service","analyst_note":"Find the fixed Routinator version and the advisory at the NVD link or the project's release notes; the sources do not name it.","how_to_check":"- Check whether the HTTP or RTR server is reachable from untrusted networks, for example with `routinator server --http` settings or firewall rules, since the sources say only those deployments are affected\n- Confirm the installed version with `routinator --version` and compare it with the fixed release, which the sources do not name","needs_analyst":true,"not_affected_if":["internal-only-network","no-http-or-rtr-server"],"who_is_affected":"Only deployments that expose Routinator's HTTP or RTR server to untrusted networks are affected, because the attack relies on opening many connections to that server. Routinator instances that serve only trusted networks or run without a network-facing server can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3330,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-72752':13A,16A 'addit':110C 'affect':133C 'arriv':39B 'attack':59B,98C 'avail':142C 'carri':52B 'concurr':2A,33B,89C 'condit':91C 'connect':64B,105C 'crash':8A,43B 'cve':11A,14A 'discard':57B,128C 'exhaust':5A,70B 'exit':118C 'host':22B 'http':67B,108C,138C 'item':51B,122C 'json':3A,37B,83C 'larg':102C 'make':136C 'malici':95C 'mani':32B,63B,87C 'memori':6A,30B,71B,80C 'metadata':55B,126C 'much':54B,125C 'network':145C 'number':103C 'open':62B,100C 'output':38B,84C 'overflow':47B,116C 'packag':17B 'payload':50B,121C 'process':10A 'request':4A,34B,86C 'routin':1A,18B,23B,76C,111C 'rpki':19B,25B 'rtr':140C 'run':27B,77C,112C 'self':21B 'self-host':20B 'server':68B,109C,141C 'servic':75B 'stack':46B,115C 'take':73B 'time':88C 'trigger':94C 'untrust':144C 'user':134C 'valid':26B","nicknames":[],"mitigations":[],"who_affected":"Only deployments that expose Routinator's HTTP or RTR server to untrusted networks are affected, because the attack relies on opening many connections to that server. Routinator instances that serve only trusted networks or run without a network-facing server can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72752","severity":null,"published_at":"2026-10-26T18:18:40+00:00","modified_at":"2026-10-26T18:18:40+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}