Resource exhaustion in Routinator - CVE-2026-72757
Published: October 27, 2026
Vulnerability identifier: #VU157711
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72757
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service in the Routinator HTTP server.
The vulnerability exists due to connection resource exhaustion in the Routinator HTTP server when handling many connections that remain open. A remote attacker can open a large number of connections and leave them unclosed to exhaust available connections and make the HTTP server unavailable.
Only deployments that expose their HTTP or RTR server to untrusted networks are affected.
Affected software
Routinator
How to mitigate CVE-2026-72757
Install security update from vendor's website.
Routinator - update to 0.15.3