CVE-2026-72758: Routinator may exit on malformed ranges
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Routinatorto a version that resolves this vulnerability.Fixed in 0.15.3
Event History
Frequently Asked Questions
Who can trigger the denial of service?
An unauthenticated attacker can trigger it over the network; the vector is network-based, requires low attack complexity, and needs no user interaction or privileges.
What happens when the issue is exploited?
Routinator can fail to terminate while parsing an AS range whose maximum is smaller than its minimum, consuming memory until it runs out and exits. The stated impact is availability only, with no listed confidentiality or integrity impact.
What malformed input condition should be checked for?
Look for AS ranges where the maximum value is numerically smaller than the minimum value. That reversed range condition causes the parser not to reach its termination value.