Live › vulnerability › CVE-2026-72757
Go to dashboardRoutinator, an RPKI validator, can run out of open connections on its HTTP server when clients open many connections and never close them. An attacker who opens a large number of such connections can make the HTTP server unavailable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Only deployments that expose Routinator's HTTP or RTR server to untrusted networks are exposed, since the attack needs the ability to open many connections to that server. Instances reachable only from trusted internal networks can skip it.
No product ranges from the sources yet.
routinator --version and compare against the fixed version in the advisory (unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.
This only affects users that make their HTTP or RTR server available to untrusted networks.
This page as .md · .json · in your agent: get_signal("CVE-2026-72757")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.