---
id: "CVE-2026-72757"
kind: "vulnerability"
aliases: ["CVE-2026-72757"]
title: "Routinator: unclosed HTTP connections exhaust server, causing denial of service"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "routinator", "rpki", "self-hosted"]
not_affected_if: ["internal-network-only", "not-exposed-to-untrusted-networks"]
published_at: "2026-10-26T18:18:42+00:00"
first_seen_at: "2026-10-26T18:31:44+00:00"
updated_at: "2026-10-26T18:34:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72757", "first_seen_at": "2026-10-26T18:31:44+00:00"}]
---

# Routinator: unclosed HTTP connections exhaust server, causing denial of service

Routinator, an RPKI validator, can run out of open connections on its HTTP server when clients open many connections and never close them. An attacker who opens a large number of such connections can make the HTTP server unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `routinator --version` and compare against the fixed version in the advisory (unknown from the sources).
- Check whether the HTTP server is bound to an address reachable from untrusted networks (unknown from the sources for specific config keys).

## Fix

- Upgrade Routinator to a release containing the fix (version unknown from the sources).
- Restrict access to the Routinator HTTP and RTR servers to trusted networks, for example with a firewall or reverse proxy rule.

## Timeline

- 2026-10-26T18:31:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-72757

## From the sources

Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.

This only affects users that make their HTTP or RTR server available to untrusted networks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_