CVE Feed

    Dashboard / CVE / CVE-2026-72752

    CVE-2026-72752

    Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once. This only affects users that make their HTTP or RTR server available to untrusted networks.

    Published:Oct 26, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 26, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Nlnetlabs
    Product
    Routinator

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-72758 (CVSS 7.5) — When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of…
    CVE-2026-72757 (CVSS 5.3) — Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, …
    CVE-2026-72756 (CVSS 7.5) — Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk…
    CVE-2026-72755 (CVSS 3.8) — Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwrit…
    CVE-2026-72754 (CVSS 7.5) — When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters…
    CVE-2026-72753 (CVSS 8.2) — When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and …
    CVE-2026-49235 (CVSS 8.7) — When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator c…
    CVE-2026-49234 (CVSS 8.2) — When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endp…
    CVE-2026-49233 (CVSS 8.3) — Routinator does not properly check the module component of rsync URIs, which are used to create the file syste…
    CVE-2026-49232 (CVSS 8.7) — Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover f…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-72752 — Nlnetlabs (Medium 6.5) | CVE-DB