CVE-2026-72752: Routinator exits when requesting the output repeatedly
Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once.
This only affects users that make their HTTP or RTR server available to untrusted networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects users that make their Routinator HTTP or RTR server available to untrusted networks. Deployments not exposed to untrusted networks are not identified as affected by the provided information.
What does an attacker need to do to cause an outage?
An attacker can open a large number of connections to the HTTP server and repeatedly request JSON output, causing memory exhaustion. A payload item with excessive metadata can also trigger a stack overflow when it is discarded.
What is the expected impact of successful exploitation?
Successful exploitation can cause Routinator to exit, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.
What can be done if a fix cannot be applied immediately?
Do not make the Routinator HTTP or RTR server available to untrusted networks. Restrict access to trusted networks to reduce exposure to malicious connection flooding and crafted payloads.