Routinator EUVD-2026-110026

Exploitation requires Routinator to fetch an RRDP notification file whose contents the attacker controls - i.e. a malicious or compromised RPKI publication point within the trust hierarchy, or a man-in-the-middle on the RRDP transport - rather than any crafted request to an exposed Routinator port. Two concrete triggers from the description: (1) a notification file whose delta entries contain gaps, which Routinator accepts and parses instead of rejecting, yielding incomplete/missing data (integrity); (2) a notification file declaring too many delta entries, causing memory exhaustion and crash (availability). Limiting factors: the attacker must be able to serve crafted RRDP content to the validator, so the realistic threat actor is a rogue/compromised CA or repository operator, or a network-path attacker - not an arbitrary remote host.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, 8.2) is driven almost entirely by A:H (memory exhaustion / crash of the validator) plus I:L (silently accepting delta gaps, causing missing data); there is no confidentiality impact (C:N). The vendor-assigned priority is 'this_week', not act_now or emergency. No EPSS score, no CISA KEV listing, and no public PoC reference were supplied, so exploitation pressure appears low. The important caveat the raw CVSS hides: although PR:N/AV:N suggest trivial remote reach, exploitation is not against arbitrary internet-exposed Routinator instances - it requires the attacker to control the RRDP content Routinator fetches (a malicious or compromised RPKI publication point, or a MITM on that fetch), which is a meaningful real-world limiter. The 'Information Disclosure' tag conflicts with C:N and appears mislabeled; this is an integrity/availability issue, not disclosure. Net: a genuine availability (DoS) and data-correctness concern for RPKI validation operators, worth patching on a normal cycle, but not an actively-exploited emergency.

A malicious or compromised RPKI publication point (any delegated CA can operate one), or an attacker positioned to tamper with an RRDP fetch, serves Routinator a crafted notification file. In one variant the delta list contains gaps that Routinator accepts and parses anyway, causing it to work from incomplete repository data; in another the file declares an excessive number of delta entries, driving Routinator to exhaust memory and crash. No public exploit identified at time of analysis.