Routinator CVE-2026-72758

Exploitation requires that Routinator parse an AS range in RPKI data where the range's maximum value is smaller than its minimum value. The practical prerequisite is that an attacker be able to place such a malformed AS range into RPKI data that a target Routinator instance fetches and validates - i.e., the ability to publish RPKI objects in a repository the validator processes, consistent with the RPKI publication trust model. Limiting factors: the attacker does not control which validators fetch the data, and the impact is confined to availability (process crash / memory exhaustion of the validator) with no confidentiality or integrity effect; no user interaction is required. The specific internal trigger (unbounded loop versus unbounded allocation) is not detailed beyond the memory-exhaustion behavior in the available sources.

This is a genuine availability-only denial-of-service issue, not an over-scored critical. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores impact exclusively on availability (C:N/I:N), consistent with the description of memory exhaustion while parsing an inverted AS range (max < min), classified CWE-755 (improper handling of an exceptional condition). The vuln.today decision label is this_week, indicating prompt but non-emergency remediation. No EPSS probability, no CISA KEV listing, and no proof-of-concept are present in the input, so there is no signal of active or widespread exploitation - the priority rests on ease of triggering plus the operational role of the affected software rather than observed attacks. One important caveat: PR:N assumes the malformed AS range reaches Routinator without privileges, but in the RPKI trust model the attacker must be able to publish signed RPKI data that the validator fetches, which is a meaningful practical prerequisite not captured by the raw vector - verify the real trigger path with the NLnet Labs advisory.

An attacker who can publish RPKI data (e.g., a repository or CA under some resource allocation) crafts an object containing an AS range whose maximum value is smaller than its minimum. When a Routinator instance fetches and parses this range during RPKI validation, it never reaches the maximum bound and exhausts available memory, crashing the validator. No public exploit code is identified in the available data, and the CVSS AC:L/AV:N vector suggests a low-complexity remote trigger once the malformed data is reachable.