CVE-2026-72757: Routinator HTTP server becomes unavailable with many unclosed connections
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.
This only affects users that make their HTTP or RTR server available to untrusted networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only deployments that make the Routinator HTTP or RTR server available to untrusted networks are affected. Deployments limited to trusted networks are not identified as affected by the provided information.
What does an attacker need to do to trigger the condition?
An attacker can trigger it by opening a large number of connections to the HTTP server and leaving them unclosed. No privileges or user interaction are required according to the supplied severity vector.
What is the operational impact?
Routinator can exhaust the open connections available to its HTTP server, making that server unavailable. The provided impact information indicates an availability impact only, with no confidentiality or integrity impact stated.