CVE-2026-72758 Details
Description
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
A memory exhaustion vulnerability has been identified in NLnet Labs Routinator when parsing Autonomous System (AS) ranges. The issue occurs if the maximum value of the range is less than the minimum value, causing Routinator to fail to reach the maximum and ultimately run out of memory. This vulnerability affects Routinator versions prior to 0.15.3.
Users can upgrade to Routinator version 0.15.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NLnet Labs Routinator | <= 0.15.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | New CVE Received | [email protected] |
| Oct 26, 2026 | CVE Modified | CISA-ADP |