Description
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.

This only affects users that make their HTTP or RTR server available to untrusted networks.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via HTTP connection exhaustion
Action: Apply Patch
AI Analysis

Impact

Routinator’s HTTP server can be made unavailable when an attacker opens many connections that are never closed, exhausting the server’s limit of open connections. This leads to a denial of service condition that affects the availability of the HTTP or RTR services.

Affected Systems

The vulnerability affects NLnet Labs Routinator releases earlier than version 0.15.3. Any installation that exposes the HTTP or RTR listener to untrusted networks is susceptible.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker sending a large number of connections to the HTTP endpoint from an untrusted network, which is inferred from the description.

Generated by OpenCVE AI on October 26, 2026 at 18:36 UTC.

Remediation

Vendor Solution

This issue is fixed in 0.15.3 and all later versions.

OpenCVE Recommended Actions

  • Upgrade Routinator to version 0.15.3 or later.
  • Restrict the HTTP and RTR servers to trusted networks or apply firewall rules to block external connections.
  • Enable connection limits or close idle connections on the server to prevent resource exhaustion.

Generated by OpenCVE AI on October 26, 2026 at 18:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs routinator
Vendors & Products Nlnetlabs
Nlnetlabs routinator

Mon, 26 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. This only affects users that make their HTTP or RTR server available to untrusted networks.
Title Routinator HTTP server becomes unavailable with many unclosed connections
Weaknesses CWE-755
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Nlnetlabs Routinator
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-10-26T17:57:33.452Z

Reserved: 2026-08-10T14:08:41.336Z

Link: CVE-2026-72757

cve-icon Vulnrichment

Updated: 2026-10-26T17:49:49.790Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T18:18:42.507

Modified: 2026-10-26T18:35:08.450

Link: CVE-2026-72757

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:30:15Z

Weaknesses
  • CWE-755

    Improper Handling of Exceptional Conditions