CVE-2026-72756: Routinator exits on malformed rsync URIs
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.3
Event History
Frequently Asked Questions
What access does an attacker need to trigger the issue?
The vector is network-accessible, requires low attack complexity, and does not require privileges or user interaction. Exploitation involves an rsync URI for a file obtained over RRDP with a path that cannot be stored on disk.
What is the expected impact?
The reported impact is a denial of service: Routinator exits. The supplied vector indicates high availability impact, with no reported confidentiality or integrity impact.
Which malformed paths are relevant for detection or triage?
Examples include paths containing file names that are too long to store on disk and folder names that overlap with existing file names. Investigate RRDP-obtained files whose associated rsync URIs create these filesystem-path conflicts.