Routinator EUVD-2026-110025

Exploitation is limited to deployments that make the Routinator HTTP or RTR server available to untrusted networks - the vendor explicitly states only such users are affected, so operators who bind these services to localhost or trusted management segments are not exposed. Given that gate, no authentication or user interaction is required (PR:N/UI:N) and complexity is low: the OOM path needs only a high volume of concurrent JSON-output requests, and the stack-overflow path needs a payload item carrying excessive metadata that is discarded at once. The practical limiting factors are the non-default exposure of the server to untrusted networks and the vendor-assigned adjacent (AV:A) attack vector, which narrows reach versus a fully internet-wide attack unless the service is internet-facing.

This is a medium-severity availability-only flaw (vendor CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact - it is a denial-of-service, not a code-execution issue, despite the 'Buffer Overflow' tag. Two distinct defects exist: memory exhaustion (OOM) triggered by many concurrent JSON-output requests, and a stack overflow causing the process to exit when a payload item with excessive metadata is discarded. CWE-755 (improper handling of exceptional conditions) matches the availability-only, crash/exhaustion behaviour far better than a memory-corruption buffer overflow. Exploitation status is no public exploit identified at time of analysis - the input lists no KEV entry, no EPSS score, and no PoC reference (the single reference is the vendor advisory). The vuln.today decision label is 'this_month', indicating prioritized but non-emergency remediation. A key signal to verify: the vendor vector is AV:A (adjacent), yet the description frames the trigger as opening connections to an exposed HTTP/RTR server, which for internet-facing deployments would be a network (AV:N) condition - the real attack surface depends on where the operator binds these services. Net: a real but bounded priority, gated by the operator exposing the server to untrusted networks, with worst case being a crash/restart of the RPKI validator rather than data compromise.

An attacker with reachability to a Routinator HTTP server exposed on an untrusted network opens a large number of concurrent connections repeatedly requesting the JSON output, driving the process out of memory. Alternatively, a crafted payload item carrying excessive metadata is discarded all at once, triggering a stack overflow that makes Routinator exit. No public exploit is identified at time of analysis; the attack requires no authentication (PR:N) and low complexity (AC:L).