Routinator CVE-2026-49232

The Routinator HTTP server or RTR server must be reachable from the attacker's network - the vendor explicitly states the issue only affects users that make these listeners available to untrusted networks, so deployments that bind RTR/HTTP to localhost or a management VLAN reachable only by trusted routers are not exposed. No authentication, user interaction, or special configuration beyond the default accept loop is required (CVSS AV:N/AC:L/AT:N/PR:N/UI:N), and the attacker needs only the ability to open enough concurrent TCP connections to push the Routinator process over its open file descriptor limit, which is bounded by the system or systemd-unit ulimit rather than by any application-level rate control.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L produces a score of 8.7, reflecting that the attack is network-reachable, requires no privileges, no user interaction, no additional preconditions, and yields high availability impact on the vulnerable component plus low subsequent availability impact on the routing systems that depend on its VRP feed - which is realistic, since a crashed Routinator means RTR clients eventually fall back to stale or empty data and BGP route validation degrades. No EPSS score, KEV listing, or POC is provided in the input, so exploitation likelihood signals are absent; the only mitigating factor is the explicit scoping note that the bug requires the HTTP or RTR listener to be exposed to untrusted networks, and operational guidance typically restricts the RTR port to trusted router peers. The 'Information Disclosure' tag in the input conflicts with both the CVSS impact metrics (VC:N/VI:N) and the description, which describes pure availability loss - defenders should treat this as a DoS, not a confidentiality issue, and disregard the tag.

An attacker who can reach an exposed Routinator HTTP or RTR port opens a large number of concurrent TCP connections from one or more hosts until the validator's per-process file descriptor table is exhausted; the next accept() call returns an error such as EMFILE, Routinator treats it as fatal and exits. Downstream BGP routers lose their RTR feed, route-origin validation degrades to stale or NotFound state depending on local policy, and the attacker repeats the cycle if Routinator is auto-restarted to keep the validator offline. No public PoC is referenced in the available data.