{"id":"CVE-2026-72754","kind":"vulnerability","aliases":["CVE-2026-72754"],"related":[],"title":"Routinator: large certificate revocation lists exhaust memory or hang validation","description":"When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.","summary":"Routinator, an RPKI validator, hangs or runs out of memory when it processes a certificate revocation list (CRL) with many entries. A malformed CRL with the wrong encoding can also make it exit.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","routinator","rpki","self-hosted"],"not_affected_if":["no-routinator"],"how_to_check":"- Check the installed Routinator version with `routinator --version`.\n- Confirm whether the validator fetches CRLs from repositories that could serve an oversized or malformed CRL.","fix":"- Upgrade Routinator to a fixed release; the fixed version is unknown from the sources.\n- Restart the validator under a process supervisor so an exit does not leave RPKI data stale.","status":"open","published_at":"2026-10-26T18:18:41+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:47+00:00","updated_at":"2026-10-26T18:33:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:33:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Routinator to a fixed release; the fixed version is unknown from the sources.\n- Restart the validator under a process supervisor so an exit does not leave RPKI data stale.","reach":"network","title":"Routinator: large certificate revocation lists exhaust memory or hang validation","impact":"medium","summary":"Routinator, an RPKI validator, hangs or runs out of memory when it processes a certificate revocation list (CRL) with many entries. A malformed CRL with the wrong encoding can also make it exit.","category":"package","nicknames":[],"who_cares":["routinator","rpki","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"validator hangs or crashes, exhausting memory on the host","analyst_note":"Check the NVD entry and the Routinator release notes for the fixed version and whether the attack needs a malicious repository or a served CRL.","how_to_check":"- Check the installed Routinator version with `routinator --version`.\n- Confirm whether the validator fetches CRLs from repositories that could serve an oversized or malformed CRL.","needs_analyst":true,"not_affected_if":["no-routinator"],"who_is_affected":"Operators who run Routinator to validate RPKI data from publication repositories are exposed, since the flaw is triggered by the CRL contents those repositories serve. Teams that only consume validated output from a third-party validator and do not run Routinator can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000594,"input_tokens":3261,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-72754':13A,16A 'also':52B 'certif':3A,37B 'crl':40B,46B,60C,76C 'cve':11A,14A 'encod':50B,81C 'encount':58C,74C 'entri':43B,63C 'exhaust':6A 'exit':55B,84C 'file':77C 'hang':9A,27B,66C 'host':22B 'larg':2A 'list':5A,39B 'make':53B 'malform':45B 'mani':42B,62C 'may':65C,83C 'memori':7A,32B,71C 'packag':17B 'process':35B 'revoc':4A,38B 'routin':1A,18B,23B,57C,73C 'rpki':19B,25B 'run':29B,68C 'self':21B 'self-host':20B 'valid':10A,26B 'wrong':49B,80C","nicknames":[],"mitigations":[],"who_affected":"Operators who run Routinator to validate RPKI data from publication repositories are exposed, since the flaw is triggered by the CRL contents those repositories serve. Teams that only consume validated output from a third-party validator and do not run Routinator can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72754","severity":null,"published_at":"2026-10-26T18:18:41+00:00","modified_at":"2026-10-26T18:18:41+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}