{"id":"CVE-2026-72757","kind":"vulnerability","aliases":["CVE-2026-72757"],"related":[],"title":"Routinator: unclosed HTTP connections exhaust server, causing denial of service","description":"Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.\n\nThis only affects users that make their HTTP or RTR server available to untrusted networks.","summary":"Routinator, an RPKI validator, can run out of open connections on its HTTP server when clients open many connections and never close them. An attacker who opens a large number of such connections can make the HTTP server unavailable.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","routinator","rpki","self-hosted"],"not_affected_if":["internal-network-only","not-exposed-to-untrusted-networks"],"how_to_check":"- Run `routinator --version` and compare against the fixed version in the advisory (unknown from the sources).\n- Check whether the HTTP server is bound to an address reachable from untrusted networks (unknown from the sources for specific config keys).","fix":"- Upgrade Routinator to a release containing the fix (version unknown from the sources).\n- Restrict access to the Routinator HTTP and RTR servers to trusted networks, for example with a firewall or reverse proxy rule.","status":"open","published_at":"2026-10-26T18:18:42+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:34:11+00:00","updated_at":"2026-10-26T18:34:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:34:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Routinator to a release containing the fix (version unknown from the sources).\n- Restrict access to the Routinator HTTP and RTR servers to trusted networks, for example with a firewall or reverse proxy rule.","reach":"internet","title":"Routinator: unclosed HTTP connections exhaust server, causing denial of service","impact":"low","summary":"Routinator, an RPKI validator, can run out of open connections on its HTTP server when clients open many connections and never close them. An attacker who opens a large number of such connections can make the HTTP server unavailable.","category":"package","nicknames":[],"who_cares":["routinator","rpki","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"HTTP server becomes unavailable to legitimate clients through connection exhaustion","analyst_note":"Fixed version and affected version range are not in the sources; check the NVD entry and Routinator release notes.","how_to_check":"- Run `routinator --version` and compare against the fixed version in the advisory (unknown from the sources).\n- Check whether the HTTP server is bound to an address reachable from untrusted networks (unknown from the sources for specific config keys).","needs_analyst":true,"not_affected_if":["internal-network-only","not-exposed-to-untrusted-networks"],"who_is_affected":"Only deployments that expose Routinator's HTTP or RTR server to untrusted networks are exposed, since the attack needs the ability to open many connections to that server. Instances reachable only from trusted internal networks can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3316,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-72757':13A,16A 'affect':107C 'attack':47B,93C 'avail':116C 'caus':7A 'client':38B 'close':44B,79C 'condit':86C 'connect':4A,32B,41B,55B,67C,74C,100C 'cve':11A,14A 'denial':8A 'exhaust':5A 'host':22B 'http':3A,35B,59B,70C,82C,103C,112C 'larg':51B,97C 'leav':80C 'make':57B,110C 'malici':90C 'mani':40B,73C 'network':119C 'never':43B,78C 'number':52B,98C 'open':31B,39B,49B,66C,76C,95C 'packag':17B 'routin':1A,18B,23B,62C 'rpki':19B,25B 'rtr':114C 'run':28B,63C 'self':21B 'self-host':20B 'server':6A,36B,60B,71C,83C,104C,115C 'servic':10A 'trigger':89C 'unavail':61B,84C 'unclos':2A 'untrust':118C 'user':108C 'valid':26B","nicknames":[],"mitigations":[],"who_affected":"Only deployments that expose Routinator's HTTP or RTR server to untrusted networks are exposed, since the attack needs the ability to open many connections to that server. Instances reachable only from trusted internal networks can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72757","severity":null,"published_at":"2026-10-26T18:18:42+00:00","modified_at":"2026-10-26T18:18:42+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}