Search/CVE-2026-72752
● CVE — Medium

CVE-2026-72752

DiscoveredOct 26, 2026UpdatedOct 26, 2026

Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once. This only affects users that make their HTTP or RTR server available to untrusted networks.

CVSS v3.1
6.5 MEDIUM
EPSS
0.24%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorADJACENT
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Connections
1 relationships
Timeline
disclosure → media coverage
Oct 26, 2026
Disclosure — published as a CVE record.