CVE-2026-49232: Routinator exits when accepting an incoming HTTP or RTR connection fails
Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP or RTR server.
This only affects users that make their HTTP or RTR server available to untrusted networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.2 - Compensating control
Do not expose the Routinator HTTP or RTR server to untrusted networks. Restrict access to these services using firewall rules, network ACLs, or by binding services to trusted interfaces only until you can upgrade to 0.15.2 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49232?
The severity of CVE-2026-49232 is high with a CVSS score of 8.7.
How do I fix CVE-2026-49232?
To fix CVE-2026-49232, upgrade to Routinator version 0.15.2 or later.
What causes CVE-2026-49232?
CVE-2026-49232 is caused by Routinator exiting when it encounters errors while accepting incoming HTTP or RTR connections.
Can CVE-2026-49232 be exploited remotely?
Yes, CVE-2026-49232 can be exploited remotely by an attacker opening a large number of connections to the server.
What is the impact of CVE-2026-49232?
The impact of CVE-2026-49232 is that the Routinator service becomes unavailable due to unexpected exits.