---
id: "CVE-2026-72758"
kind: "vulnerability"
aliases: ["CVE-2026-72758"]
title: "Routinator: inverted AS range parsing exhausts memory and crashes validator"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bgp", "network-operators", "package", "routinator", "rpki"]
not_affected_if: ["not-running-routinator"]
published_at: "2026-10-26T18:18:42+00:00"
first_seen_at: "2026-10-26T18:31:44+00:00"
updated_at: "2026-10-26T18:33:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72758", "first_seen_at": "2026-10-26T18:31:44+00:00"}]
---

# Routinator: inverted AS range parsing exhausts memory and crashes validator

Routinator, an RPKI validator, loops forever when an AS range has a maximum smaller than its minimum while parsing. The process runs out of memory, which denies service to anything relying on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Routinator version with `routinator --version` and compare it against the fixed release named in the advisory.
- unknown

## Fix

- Upgrade Routinator to the patched release named in the NVD or project advisory.
- unknown

## Timeline

- 2026-10-26T18:31:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-72758

## From the sources

When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_