CVE-2026-72757 in Routinator
Summary
by MITRE • 10/26/2026
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.
This only affects users that make their HTTP or RTR server available to untrusted networks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability in Routinator represents a classic resource exhaustion flaw within its embedded HTTP server, specifically manifesting as a denial-of-service condition caused by an accumulation of unclosed connections. When the application is configured to expose its HTTP interface to external or untrusted networks, it becomes susceptible to attacks where an adversary opens numerous TCP connections and deliberately fails to terminate them properly. This behavior leads to the depletion of available file descriptors or socket handles that the operating system allocates for network communication. As these resources are consumed by idle or half-open sessions, the server reaches its maximum connection limit and ceases to accept new legitimate requests, effectively rendering the service unavailable to authorized users who rely on it for Route Origin Authorization validation and other critical routing security functions.
From a technical perspective, this issue stems from insufficient resource management practices within the application's network handling logic. The software does not implement adequate timeouts or connection limits that would automatically close inactive sessions after a defined period of inactivity. Consequently, an attacker can exploit this lack of enforcement by maintaining persistent connections without sending further data, thereby holding onto system resources indefinitely. This aligns with CWE-770, which describes the allocation of resources without proper release, and falls under the broader category of resource exhaustion vulnerabilities that are prevalent in network-facing services lacking robust connection lifecycle management. The impact is strictly localized to environments where the HTTP or RTR server endpoints are accessible from untrusted networks, as internal-only deployments remain protected by perimeter security controls such as firewalls that restrict access to known IP ranges.
The operational impact of this vulnerability can be severe for organizations relying on Routinator for BGP security infrastructure. Since Route Origin Authorization data is essential for validating the legitimacy of route announcements and preventing prefix hijacking, a denial-of-service condition disrupts the ability of network operators to perform real-time validation checks. This disruption may lead to delayed detection of malicious routing activities or force administrators to revert to less secure manual verification processes during an attack window. Furthermore, because the HTTP server is often used by monitoring tools and automation scripts to retrieve status information and configuration data, its unavailability can blind security operations centers to critical changes in the network's routing posture, potentially masking ongoing attacks that exploit similar resource exhaustion techniques against other services.
Mitigation strategies must focus on both architectural hardening and operational controls to prevent exploitation of this flaw. The most effective immediate measure is to restrict access to the HTTP server exclusively through trusted networks using firewall rules or security groups, ensuring that only authorized management stations can connect to these endpoints. Additionally, deploying a reverse proxy such as Nginx or Apache in front of Routinator provides an additional layer of defense by enforcing connection limits and timeouts at the infrastructure level before requests reach the application. Administrators should also configure operating system-level parameters like ulimit for file descriptors and TCP keepalive settings to automatically terminate stale connections after a reasonable duration. Long-term remediation requires updating Routinator to versions that include fixes for this resource management issue, ensuring that the software itself implements proper connection pooling, idle timeout mechanisms, and rate limiting to gracefully handle high volumes of concurrent requests without exhausting system resources.