CVE-2026-72756
Deferred Deferred - Pending Action

Routinex exits on invalid RRDP rsync URI path

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: NLnet Labs

Description
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-72756
EUVD
EUVD-2026-110029

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nlnetlabs routinator to 0.15.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Routinator crashes when processing malformed rsync URIs in files obtained via RRDP. This happens if the URI contains paths that cannot be stored on disk, such as excessively long filenames or overlapping folder names with existing files.

Detection Guidance

Check if Routinator is running and examine logs for crashes or exits related to malformed rsync URIs. Look for errors indicating path storage failures or overlapping folder names.

Impact Analysis

This vulnerability can cause Routinator to terminate unexpectedly, disrupting RPKI validation services. It may lead to unavailability of route origin validation, affecting network security and routing decisions.

Mitigation Strategies

Upgrade Routinator to version 0.15.3 or later to address the issue. Monitor system logs for crashes and ensure no critical services depend on the vulnerable version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart