CVE-2026-72753 in Routinator
Summary
by MITRE • 10/26/2026
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified within the Route Origin Authorisation (ROA) validation tool Routinator stems from insufficient input validation regarding Resource Public Key Infrastructure (RPKI) RRDP notification files. Specifically, the software fails to detect and reject notification files that contain gaps in their delta entries sequence. In a correctly functioning RPKI system, delta updates are sequential and contiguous, allowing validators to apply changes incrementally without re-fetching entire data sets. When Routinator accepts these malformed notifications with missing intermediate deltas, it proceeds to parse the available data but inevitably results in an incomplete or inconsistent local repository state. This gap means that certain route origin authorizations may be silently ignored during validation processes, leading to a divergence between the validator's view of trust anchors and the actual published records on the RPKI infrastructure.
The operational impact of this flaw is significant for network operators relying on Routinator for BGP security decisions. Because the tool accepts incomplete delta updates without error or warning, it may validate routes based on outdated or missing ROA data. This can lead to false negatives where invalid route announcements are not flagged as such, potentially allowing hijacked prefixes to propagate through the internet backbone undetected by systems dependent on this validator's output. Conversely, in scenarios involving rapid changes to large numbers of ROAs, the second aspect of the vulnerability becomes critical. The software lacks adequate bounds checking for the number of delta entries processed from a single notification file. If an attacker or a misconfigured server provides a notification with an excessively high count of deltas, Routinator attempts to allocate memory for all these entries simultaneously. This unbounded resource consumption can lead to out-of-memory conditions, causing the application to crash or become unresponsive. Such denial of service impacts disrupt continuous monitoring and validation services, leaving networks vulnerable during periods when security posture assessment is most critical.
From a technical classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the software does not adequately verify the structural integrity and continuity of incoming RRDP notification files before processing them. The failure to enforce sequence continuity allows for data inconsistency, while the lack of limits on delta entry counts exposes the system to resource exhaustion. Furthermore, this behavior can be mapped to MITRE ATT&CK techniques related to Resource Hijacking or Denial of Service via application layer exploits. Attackers could potentially exploit these flaws by crafting malicious RRDP notification files that either introduce gaps in update sequences or flood the validator with excessive delta entries, thereby compromising the integrity and availability of RPKI validation services.
Mitigation strategies for this vulnerability involve both immediate operational adjustments and long-term software updates. Users should ensure they are running patched versions of Routinator where these input validation checks have been implemented to reject non-contiguous delta sequences and enforce strict limits on memory allocation per update cycle. In the interim, network operators can implement monitoring scripts that validate the continuity of RRDP notifications received from their configured repositories before feeding them into the validator. Additionally, configuring system-level resource controls such as ulimits or container memory constraints can provide a safety net against out-of-memory crashes caused by excessive delta entries. It is also advisable to verify the health and consistency of RPKI data sources regularly using independent validation tools to detect any discrepancies that may arise from this flaw until an official patch is deployed.