CVE-2026-72753: high-severity vulnerability in NLnet Labs Routinator
Routinator incorrectly handles delta updates
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.4%
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
NLnet Labs · RoutinatorRelated CVEs — NLnet Labs Routinator
In the same product, most dangerous first.
CVE-2021-43173—Hanging RRDP requestEPSS 1.4%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.1%CVE-2021-43172—Infinite length chain of RRDP repositoriesEPSS 1.1%CVE-2024-1622HIGHRoutinator terminates when RTR connection is reset too quickly after openingEPSS 1.0%CVE-2021-41531—Invalid RPKI data could disable Route Origin Validation on RTR clients.EPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.8%