CVE-2026-72754: Routinator exits when parsing an incorrect or very large CRL file
Published Oct 26, 2026
·Updated
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
Affected Software
1 affected component
Nlnet Labs Routinator
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.3
Event History
Oct 26, 2026
CVE Published
via MITRE·05:06 PM
Data Sourced
via MITRE·05:06 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can trigger the denial of service?
The vector indicates network reachability and no privileges or user interaction are required. An attacker able to provide a malformed or exceptionally large CRL that Routinator processes could cause it to hang, consume memory, or exit.
2
What operational symptoms indicate possible exploitation or exposure?
Relevant symptoms are Routinator hanging, unusually high memory consumption while parsing a CRL with many entries, or an unexpected Routinator exit when it encounters a CRL with incorrect encoding.