CVE-2026-72752
Deferred Deferred - Pending Action

Routinator Memory Exhaustion and Stack Overflow Vulnerabilities

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: NLnet Labs

Description
Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once. This only affects users that make their HTTP or RTR server available to untrusted networks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-72752
EUVD
EUVD-2026-110025

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nlnetlabs routinator to 0.15.2 (inc)
nlnetlabs routinator From 0.15.3 (inc)
nlnetlabs routinator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Routinator runs out of memory when JSON output is requested many times concurrently, which can be triggered by an attacker opening many connections. It also crashes due to a stack overflow when discarding payload items with excessive metadata. This only affects users exposing HTTP or RTR servers to untrusted networks.

Detection Guidance

Monitor for high memory usage or crashes in Routinator when HTTP or RTR servers are exposed to untrusted networks. Check logs for stack overflow errors or excessive connection attempts.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing Routinator, disrupting its operations. Systems relying on Routinator for RPKI validation may become unavailable, affecting network routing integrity.

Mitigation Strategies

Restrict access to Routinator's HTTP or RTR servers to trusted networks only. Limit concurrent connections and monitor for unusual traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72752. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart