---
id: "CVE-2026-72752"
kind: "vulnerability"
aliases: ["CVE-2026-72752"]
title: "Routinator: concurrent JSON requests exhaust memory and crash the process"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "routinator", "rpki", "self-hosted"]
not_affected_if: ["internal-only-network", "no-http-or-rtr-server"]
published_at: "2026-10-26T18:18:40+00:00"
first_seen_at: "2026-10-26T18:31:44+00:00"
updated_at: "2026-10-26T18:33:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72752", "first_seen_at": "2026-10-26T18:31:44+00:00"}]
---

# Routinator: concurrent JSON requests exhaust memory and crash the process

Routinator, an RPKI validator, runs out of memory when many concurrent requests for its JSON output arrive, and it can crash with a stack overflow when a payload item carrying too much metadata is discarded. An attacker who can open many connections to the HTTP server can exhaust memory and take the service down.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the HTTP or RTR server is reachable from untrusted networks, for example with `routinator server --http` settings or firewall rules, since the sources say only those deployments are affected
- Confirm the installed version with `routinator --version` and compare it with the fixed release, which the sources do not name

## Fix

- Upgrade Routinator to a release that includes the fix for CVE-2026-72752; the fixed version is unknown from the sources
- Until upgraded, restrict access to the HTTP and RTR servers to trusted networks

## Timeline

- 2026-10-26T18:31:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-72752

## From the sources

Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once.

This only affects users that make their HTTP or RTR server available to untrusted networks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_