CVE-2026-72757
Deferred Deferred - Pending Action

Routinator HTTP Server Connection Exhaustion Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: NLnet Labs

Description
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. This only affects users that make their HTTP or RTR server available to untrusted networks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-72757
EUVD
EUVD-2026-110030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nlnetlabs routinator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Routinator's HTTP server runs out of open connections when many are opened but not closed, making the server unavailable. This happens because an attacker can deliberately open numerous connections to disrupt service.

Detection Guidance

Check for unusually high numbers of open connections to the HTTP server port (default 9556) using netstat or ss. Look for connections in a 'CLOSE_WAIT' or 'ESTABLISHED' state without proper closure. Example commands: 'netstat -tulnp | grep 9556' or 'ss -tulnp | grep 9556'.

Impact Analysis

If you expose Routinator's HTTP or RTR server to untrusted networks, attackers could cause downtime by overwhelming the server with connection requests, rendering it unavailable for legitimate users.

Mitigation Strategies

Restrict HTTP or RTR server access to trusted networks only. Implement connection timeouts and limits in Routinator's configuration. Monitor and close idle connections regularly. Update Routinator to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart