Live › vulnerability › CVE-2026-72758
Go to dashboardRoutinator, an RPKI validator, loops forever when an AS range has a maximum smaller than its minimum while parsing. The process runs out of memory, which denies service to anything relying on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams that run Routinator to validate RPKI data for BGP routing are exposed when it parses AS ranges from input they accept. The sources do not say which input path (local files or remote feeds) triggers the parse, so it is unknown whether an outside party can supply the malformed range. Teams not running Routinator can skip it.
No product ranges from the sources yet.
routinator --version and compare it against the fixed release named in the advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-72758")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.