Routinator EUVD-2026-110030

Exploitation requires that the operator has deliberately made Routinator's HTTP or RTR server reachable from an untrusted network; the vendor explicitly states the issue 'only affects users that make their HTTP or RTR server available to untrusted networks.' In a standard deployment where these endpoints are bound to trusted internal networks or localhost and reached only by the operator and RTR-speaking routers, the flaw is not remotely exposed. When exposed, no authentication, no user interaction, and no special configuration beyond that network reachability are needed - the attacker simply opens many connections that are never closed. The limiting factor is therefore deployment topology (untrusted-network exposure), not any attacker-side complexity.

This is a moderate-severity availability-only flaw (CWE-755, improper handling of exceptional conditions) whose signals are internally consistent and point to a real-but-bounded risk rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) correctly reflects a remotely triggerable, low-complexity, unauthenticated condition with no confidentiality or integrity impact and only partial availability loss - the HTTP server exhausts its connection pool and stops serving while the core RPKI validation process is not stated to crash. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the modest impact. No EPSS score, no CISA KEV listing, and no PoC reference were provided, so exploitation probability signals are simply absent rather than conflicting. The single most important mitigating factor, stated by the vendor, is that the condition only affects deployments exposing the HTTP or RTR server to untrusted networks - Routinator is normally reached only by trusted internal RTR clients (routers) and operator tooling, so a correctly segmented deployment is not exposed. One cross-source discrepancy to verify: the reference advisory filename is CVE-2026-72756.txt while this record is CVE-2026-72757 - confirm with NLnet Labs that this advisory covers this CVE. Overall this is a legitimate but low-urgency availability issue, not a high-CVSS/low-real-risk mislabel nor a critical priority.

An attacker who can reach a Routinator instance that has been exposed to an untrusted network opens a large number of TCP connections to the HTTP (or RTR) server and never closes them, exhausting the server's available connection slots. Because the vector is network-based, unauthenticated, and low-complexity (AV:N/AC:L/PR:N), no credentials or user interaction are needed; once the pool is exhausted, the HTTP server becomes unavailable to legitimate clients. No public exploit identified at time of analysis.