CVE-2026-72752

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once.

This only affects users that make their HTTP or RTR server available to untrusted networks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
NLnet Labs	Routinator	—

References

https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72752.txt

Timeline

Published: Oct 26, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-727538.2When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to CVE-2026-727547.5When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong enc CVE-2026-727553.8Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificat CVE-2026-727567.5Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names,CVE-2026-727575.3Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavai CVE-2026-727587.5When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will ne CVE-2026-727596.9In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a histo CVE-2026-727605.3Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated u CVE-2026-727616.9The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IP CVE-2026-727628.8n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its outp CVE-2026-727636.5n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenc CVE-2026-727648.8n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.3