{"id":"CVE-2026-72753","kind":"vulnerability","aliases":["CVE-2026-72753"],"related":[],"title":"Routinator: RRDP delta gaps accepted, and many deltas can exhaust memory","description":"When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.","summary":"Routinator, an RPKI validator, accepts an RRDP notification file that has gaps in its delta entries and parses it anyway, which can lead to missing routing data. A notification file with too many delta entries can also make it run out of memory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network-operators","routinator","rpki"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T18:18:40+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:39+00:00","updated_at":"2026-10-26T18:33:39+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T18:33:39Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Routinator: RRDP delta gaps accepted, and many deltas can exhaust memory","impact":"medium","summary":"Routinator, an RPKI validator, accepts an RRDP notification file that has gaps in its delta entries and parses it anyway, which can lead to missing routing data. A notification file with too many delta entries can also make it run out of memory.","category":"infrastructure","nicknames":[],"who_cares":["routinator","rpki","network-operators"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Missing routing data and process memory exhaustion on the validator","analyst_note":"Find the NVD entry's affected and fixed Routinator versions and the CVSS vector, plus the upstream advisory, to fill in fix and how_to_check.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Operators who run Routinator to validate RPKI data for routing decisions are the ones affected. The sources do not say which versions are vulnerable or whether a default configuration is exposed, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000541,"input_tokens":3281,"output_tokens":425,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-72753':14A,17A 'accept':5A,28B,83C 'also':60B 'anyway':43B 'cve':12A,15A 'data':50B,90C 'delta':3A,8A,38B,57B,78C,96C 'encount':69C,93C 'entri':39B,58B,79C,97C 'exhaust':10A 'file':32B,53B,73C 'gap':4A,35B,75C 'infrastructur':18B 'lead':46B,87C 'make':61B 'mani':7A,56B,95C 'may':99C 'memori':11A,66B,103C 'miss':48B,89C 'network':20B 'network-oper':19B 'notif':31B,52B,72C 'oper':21B 'pars':41B,85C 'potenti':86C 'rout':49B 'routin':1A,22B,24B,68C 'rpki':23B,26B 'rrdp':2A,30B,71C 'run':63B,100C 'still':82C 'valid':27B","nicknames":[],"mitigations":[],"who_affected":"Operators who run Routinator to validate RPKI data for routing decisions are the ones affected. The sources do not say which versions are vulnerable or whether a default configuration is exposed, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72753","severity":null,"published_at":"2026-10-26T18:18:40+00:00","modified_at":"2026-10-26T18:18:40+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}