{"id":"CVE-2026-72758","kind":"vulnerability","aliases":["CVE-2026-72758"],"related":[],"title":"Routinator: inverted AS range parsing exhausts memory and crashes validator","description":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.","summary":"Routinator, an RPKI validator, loops forever when an AS range has a maximum smaller than its minimum while parsing. The process runs out of memory, which denies service to anything relying on it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bgp","network-operators","package","routinator","rpki"],"not_affected_if":["not-running-routinator"],"how_to_check":"- Check the installed Routinator version with `routinator --version` and compare it against the fixed release named in the advisory.\n- unknown","fix":"- Upgrade Routinator to the patched release named in the NVD or project advisory.\n- unknown","status":"open","published_at":"2026-10-26T18:18:42+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:44+00:00","updated_at":"2026-10-26T18:33:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:33:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Routinator to the patched release named in the NVD or project advisory.\n- unknown","reach":"unknown","title":"Routinator: inverted AS range parsing exhausts memory and crashes validator","impact":"medium","summary":"Routinator, an RPKI validator, loops forever when an AS range has a maximum smaller than its minimum while parsing. The process runs out of memory, which denies service to anything relying on it.","category":"package","nicknames":[],"who_cares":["routinator","rpki","bgp","network-operators"],"confidence":0.6,"needs_auth":"unknown","worst_case":"validator process exhausts memory and stops serving routing data","analyst_note":"Confirm the fixed Routinator version and which input (RPKI repository data or config) triggers the AS range parse, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-72758.","how_to_check":"- Check the installed Routinator version with `routinator --version` and compare it against the fixed release named in the advisory.\n- unknown","needs_analyst":true,"not_affected_if":["not-running-routinator"],"who_is_affected":"Teams that run Routinator to validate RPKI data for BGP routing are exposed when it parses AS ranges from input they accept. The sources do not say which input path (local files or remote feeds) triggers the parse, so it is unknown whether an outside party can supply the malformed range. Teams not running Routinator can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000598,"input_tokens":3272,"output_tokens":541,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-72758':13A,16A 'anyth':53B 'bgp':17B 'crash':9A 'cve':11A,14A 'deni':50B 'exhaust':6A 'forev':29B 'invert':2A 'loop':28B 'maximum':36B,64C,83C 'memori':7A,48B,89C 'minimum':40B,73C 'network':19B 'network-oper':18B 'never':80C 'oper':20B 'packag':21B 'pars':5A,42B,56C 'process':44B 'rang':4A,33B,59C,68C,77C 'reach':81C 'reli':54B 'routin':1A,22B,24B,61C,78C 'rpki':23B,26B 'run':45B,86C 'servic':51B 'smaller':37B,70C 'valid':10A,27B 'valu':65C,74C,84C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Routinator to validate RPKI data for BGP routing are exposed when it parses AS ranges from input they accept. The sources do not say which input path (local files or remote feeds) triggers the parse, so it is unknown whether an outside party can supply the malformed range. Teams not running Routinator can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72758","severity":null,"published_at":"2026-10-26T18:18:42+00:00","modified_at":"2026-10-26T18:18:42+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}