NLnet Labs Routinator: RRDP delta processing denial-of-service (CVE-2026-72753)
Routinator is vulnerable to a denial-of-service condition where specifically crafted or malformed RRDP notification files cause memory exhaustion during delta entry processing.
CVE search metadata
CVE search record: CVE-2026-72753. Severity: high. CVSS: 8.2. KEV: no. Product: Routinator. Brief: NLnet Labs Routinator: RRDP delta processing denial-of-service (CVE-2026-72753). Brief link: https://feed.craftedsignal.io/briefs/2026-10-routinator-rrdp-dos/
CVE search record: CVE-2026-72754. Severity: high. CVSS: 7.5. KEV: no. Product: Routinator. Brief: NLnet Labs Routinator: RRDP delta processing denial-of-service (CVE-2026-72753). Brief link: https://feed.craftedsignal.io/briefs/2026-10-routinator-rrdp-dos/
Triage facts
Revision 1- Applicability
- Routinator
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 26, 19:45 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Roughly even chance
What's new
- 1. added CVE-2026-72754 Oct 26, 19:45 via nvd
CVE-2026-72753 describes a vulnerability in Routinator's RRDP notification file handling. When the software encounters an RRDP notification file containing gaps in delta entries, it improperly accepts and parses the file, resulting in potential data inconsistency. Furthermore, processing an excessive number of delta entries within a single file can lead to memory exhaustion, resulting in a denial-of-service condition.
Impact
Successful exploitation allows for a denial-of-service condition via resource exhaustion (memory). Additionally, improper validation of delta gaps can result in the RPKI cache failing to synchronize correctly, leading to missing validation data.
Recommendation
- Monitor the Routinator project release notes for an official patch addressing CVE-2026-72753.
- Inventory systems running Routinator and prepare for an upgrade cycle once the remediating version is released.
- Limit exposure of the Routinator RRDP synchronization process to trusted RPKI repositories where possible to mitigate the risk of processing malicious or malformed notification files.
Immediate actions
Inventory all instances of Routinator within the environment to facilitate patching upon vendor release.
Threat Hunt
Identify abnormal memory growth in Routinator processes during RRDP repository synchronization.
Data: System memory usage telemetry (e.g., node_exporter, top, process monitoring)
Mitigations
Upgrade Routinator to the first version that addresses CVE-2026-72753 once available.
CVE-2026-72753