Routinator EUVD-2026-110029

Exploitation requires that Routinator be fetching repository content over RRDP (the default transport) and that the attacker can place a crafted object into an RPKI publication point within the trust chain the validator queries - i.e. the attacker must operate, compromise, or otherwise control a CA/publication-point repository that this instance validates. The crafted RRDP content must reference an rsync URI whose path cannot be stored on disk, specifically an over-long file name or a folder name that overlaps an existing file name. The limiting factor is this positional requirement: an arbitrary off-path Internet attacker cannot trigger it; they must be able to influence content served by a publication point in the Routinator instance's validation tree. The trigger beyond the named path conditions is as the advisory describes and is not further detailed in the available sources.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a pure availability impact - a denial of service - with no confidentiality or integrity effect, which directly contradicts the 'Information Disclosure' tag in the input (there is no disclosure here; the flaw is an unhandled exceptional condition, CWE-755, that causes the process to exit). The 'network/low-complexity/no-privileges' metrics overstate how trivially any Internet attacker can trigger this: in practice the attacker must operate or compromise an RPKI publication point whose RRDP repository the Routinator instance actually fetches and validates, then serve a crafted object whose rsync URI maps to a path Routinator cannot write to disk (an over-long filename, or a folder name that collides with an existing file name). No EPSS score, CISA KEV listing, or working exploit was provided - the single reference is the vendor advisory, not exploit code - so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', not act_now/emergency, consistent with a serious but not actively-exploited availability bug. Net: this is a credible operational risk to RPKI route-origin validation availability rather than a mass-exploitation emergency; the real priority is driven by how exposed a given deployment's trust chain is, and the mislabeled disclosure tag should not be used to characterize impact.

An attacker who controls or compromises an RPKI publication point in the trust tree that a Routinator instance validates serves an RRDP snapshot or delta referencing an rsync URI whose path cannot be stored locally (e.g. an excessively long file name, or a directory name that overlaps an existing file). When Routinator processes it, the unhandled filesystem error causes the process to exit, halting RPKI validation. No public exploit code was identified; only the NLnet Labs advisory is referenced.