CVE-2026-72756 in Routinator
Summary
by MITRE • 10/26/2026
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability in Routinator involves improper handling of resource synchronization protocol (rsync) URIs when they are derived from or associated with Repository for Certificate Authority Public Data (RRDP) sources. Specifically, the application fails to validate or sanitize path components obtained through these channels before attempting to write them to the local file system. This lack of rigorous input validation allows an attacker who controls or influences the RRDP data source to supply a URI containing maliciously crafted paths that violate operating system constraints on file and directory naming conventions.
The technical flaw centers on the absence of checks for path length limits and name collisions during the file storage process. When Routinator processes an rsync URI linked to RRDP content, it directly translates parts of this URI into local file or folder names without verifying if these names exceed maximum allowable lengths defined by the underlying operating system or filesystem architecture. Additionally, the software does not adequately check whether a proposed directory name conflicts with existing files in the target storage location. This oversight creates conditions where standard path traversal protections are bypassed because the issue is not about traversing outside a designated root but rather about creating invalid or destructive local structures due to unvalidated input data from external sources.
The operational impact of this vulnerability includes application instability and potential denial of service. When Routinator attempts to store files with excessively long names or conflicting folder names, it encounters errors that cause the process to exit unexpectedly. This abrupt termination disrupts the continuous monitoring and validation activities performed by Routinator, which is critical for maintaining trust in public key infrastructure (PKI) through Resource Public Key Infrastructure (RPKI). For network operators relying on this tool for route origin authorization checks, such interruptions can lead to gaps in visibility regarding BGP routing security, potentially exposing networks to misrouted traffic or other related threats if the validation service becomes unavailable.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-73 External Control of File Name or Path. The failure to restrict file names according to OS constraints represents a classic input validation weakness where trusted assumptions about data format are violated by maliciously crafted inputs from external systems like RRDP repositories. In the context of the MITRE ATT&CK framework, this behavior can be associated with techniques involving resource hijacking or disruption of security monitoring tools, although it primarily manifests as a reliability issue rather than an active exploitation vector for code execution.
Mitigation strategies should focus on implementing robust input sanitization and validation routines within Routinator before any file system operations are attempted. Developers must enforce strict length limits on all path components derived from external URIs to ensure compatibility with the widest range of operating systems, including Windows which has stricter character limits than Unix-like systems. Furthermore, the application should implement checks for name collisions against existing files and directories in the target storage location, potentially by appending unique identifiers or using hash-based naming schemes when conflicts are detected. Updating Routinator to a patched version that addresses these validation gaps is essential for maintaining service continuity and ensuring reliable RPKI data synchronization.