CVE-2026-72755: low-severity vulnerability in NLnet Labs Routinator
Routinator stores TA certificate in cache without validation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.8epss 0.2%
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected products
NLnet Labs · RoutinatorRelated CVEs — NLnet Labs Routinator
In the same product, most dangerous first.
CVE-2021-43173—Hanging RRDP requestEPSS 1.4%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.1%CVE-2021-43172—Infinite length chain of RRDP repositoriesEPSS 1.1%CVE-2024-1622HIGHRoutinator terminates when RTR connection is reset too quickly after openingEPSS 1.0%CVE-2021-41531—Invalid RPKI data could disable Route Origin Validation on RTR clients.EPSS 0.9%CVE-2022-3029—Fatal error on incorrect base64 data in RRDPEPSS 0.8%