---
id: CVE-2026-72753
title: Routinator incorrectly handles delta updates
summary: >-
  When Routinator encounters an RRDP notification file with gaps in the delta
  entries, it is still accepted and parsed, potentially leading to missing data.
  If it encounters too many delta entries it may run out of memory.
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-755
vendor: NLnet Labs
product: Routinator
affected:
  - Routinator (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T17:47:09.649259Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T17:57:34.197Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72753'
references:
  - url: 'https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72753.txt'
tags:
  - cve.org
ingestedAt: '2026-10-26T17:33:33.059Z'
epss: 0.00396
epssPercentile: 0.3367
---

## Overview

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.

## Affected

- `Routinator (all versions)`

## Remediation

This issue is fixed in 0.15.3 and all later versions.