SB2026102701 - Multiple vulnerabilities in Routinator

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102701

SB2026102701 - Multiple vulnerabilities in Routinator

Published: October 27, 2026

Security Bulletin ID SB2026102701
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-72752)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to excessive memory consumption in Routinator's HTTP server when handling many concurrent requests for JSON output. A remote attacker can open a large number of HTTP connections and repeatedly request JSON output to exhaust available memory and cause Routinator to exit.

Only deployments that expose an HTTP or RTR server to untrusted networks are affected.


2) Input validation error (CVE-ID: CVE-2026-72753)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause Routinator to omit data during delta updates.

The vulnerability exists due to improper validation of delta entry sequences in Routinator's RRDP notification processing when parsing notification files containing gaps in delta entries. A remote attacker can supply a notification file with missing delta entries to cause incomplete update data to be accepted and processed.


3) Resource exhaustion (CVE-ID: CVE-2026-72754)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of oversized or incorrectly encoded certificate revocation lists (CRLs) in Routinator's CRL parser when parsing CRL files. A remote attacker can supply a CRL containing many entries or an incorrect encoding to cause Routinator to hang, exhaust memory, or exit.


4) Improper Certificate Validation (CVE-ID: CVE-2026-72755)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to replace a known good cached trust anchor certificate with an invalid certificate, potentially disrupting subsequent validation.

The vulnerability exists due to improper certificate validation before caching in Routinator's trust anchor certificate retrieval process when retrieving certificates over HTTPS. A remote attacker can supply an invalid trust anchor certificate, if able to influence the retrieved certificate, to overwrite a known good cached certificate even if validation fails.


5) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72756)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating Routinator.

The vulnerability exists due to improper handling of filesystem error conditions in Routinator when processing rsync URIs for files obtained over RRDP. A remote attacker can supply a malformed rsync URI containing a path that cannot be stored on disk, such as an excessively long filename or a folder name conflicting with an existing filename, to cause Routinator to exit.


6) Resource exhaustion (CVE-ID: CVE-2026-72757)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service in the Routinator HTTP server.

The vulnerability exists due to connection resource exhaustion in the Routinator HTTP server when handling many connections that remain open. A remote attacker can open a large number of connections and leave them unclosed to exhaust available connections and make the HTTP server unavailable.

Only deployments that expose their HTTP or RTR server to untrusted networks are affected.


7) Infinite loop (CVE-ID: CVE-2026-72758)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to a loop with an unreachable exit condition in Routinator's AS range parser when parsing a range whose maximum value is smaller than its minimum value. A remote attacker can supply a malformed AS range to cause parsing to continue until memory is exhausted and Routinator exits.


Remediation

Install update from vendor's website.

References