CVE-2026-72753: Routinator incorrectly handles delta updates
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.3
Event History
Frequently Asked Questions
What can an unauthenticated attacker do?
An attacker able to provide or influence an RRDP notification file can exploit the issue remotely without authentication or user interaction. Gaps in delta entries can cause missing data to be accepted, while excessive delta entries can exhaust memory and affect availability.
Is the impact limited to availability?
No. The reported impact includes low integrity impact because Routinator may accept and parse delta updates with gaps, potentially resulting in missing data. Availability impact is high when too many delta entries cause memory exhaustion.
How can I determine whether an instance is affected?
Review how the instance handles RRDP notification files, particularly notifications containing gaps in delta entries or unusually large numbers of delta entries. The provided information does not identify affected or fixed Routinator versions.