Input validation error in Routinator - CVE-2026-72753
Published: October 27, 2026
Vulnerability identifier: #VU157707
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72753
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause Routinator to omit data during delta updates.
The vulnerability exists due to improper validation of delta entry sequences in Routinator's RRDP notification processing when parsing notification files containing gaps in delta entries. A remote attacker can supply a notification file with missing delta entries to cause incomplete update data to be accepted and processed.
Affected software
Routinator
How to mitigate CVE-2026-72753
Install security update from vendor's website.
Routinator - update to 0.15.3