CVE-2026-72753

In Routinator, when parsing an AS range where the maximum value is smaller than the minimum value, Routinator will never reach the maximum and run out of memory.

Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.

Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names or folder names that overlap with existing file names.

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.

When Routinator encounters a CRL with many entries, it may hang or run out of memory. If it encounters a CRL file with the wrong encoding, it may exit.

Routinator runs out of memory when the JSON output is requested many times concurrently, which an attacker can trigger maliciously by opening a large number of connections to the HTTP server. Additionally, Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once.

Vulnerability in Routinator causes a crash when encountering an RRDP file with a specially crafted Document Type Definition (DTD).

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Routinator exits on any error when accepting incoming HTTP or RTR connections, including recoverable ones like running out of file descriptors. An attacker can trigger this by opening many connections.