Routinator EUVD-2026-110027

Routinator must fetch and parse an attacker-supplied CRL that either contains a very large number of entries (triggering the hang / out-of-memory path) or uses an incorrect encoding (triggering the process exit). The concrete prerequisite is that the attacker can serve such a CRL within the RPKI repository hierarchy that the target Routinator instance validates; no authentication to Routinator itself is required. The limiting factor is this delivery requirement - the attacker needs publishing control over a repository/CA in a trusted RPKI path, which is a meaningful barrier beyond the raw AV:N rating, though no user interaction or special non-default Routinator configuration is indicated by the advisory.

All signals point to an availability-only denial-of-service issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores C:N/I:N and A:H, meaning no data is exposed or altered - only availability is affected, which directly contradicts the input 'Information Disclosure' tag. The vuln.today decision label is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation; no public exploit is identified. The practical catch the raw CVSS understates is the delivery precondition: Routinator must fetch and parse a malicious CRL, which requires the attacker to publish that CRL somewhere in the RPKI repository hierarchy Routinator validates - AV:N is technically correct but real exploitation depends on controlling a repository/CA in a validated trust path, so this is better treated as an availability-hardening fix to apply this week than as an emergency. EPSS and KEV data are both absent from the input (absence, not a low score), so exploitation likelihood cannot be quantified from the provided signals.

An attacker who can publish objects in an RPKI repository that Routinator fetches places a CRL containing a very large number of entries, causing Routinator to hang or exhaust memory during validation; alternatively they serve a CRL with an invalid encoding, causing the process to exit. The result is disruption of RPKI route origin validation for the operator running Routinator. No public exploit is identified at time of analysis.