Resource exhaustion in Routinator - CVE-2026-72752
Published: October 27, 2026
Vulnerability identifier: #VU157706
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72752
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.
The vulnerability exists due to excessive memory consumption in Routinator's HTTP server when handling many concurrent requests for JSON output. A remote attacker can open a large number of HTTP connections and repeatedly request JSON output to exhaust available memory and cause Routinator to exit.
Only deployments that expose an HTTP or RTR server to untrusted networks are affected.
Affected software
Routinator
How to mitigate CVE-2026-72752
Install security update from vendor's website.
Routinator - update to 0.15.3