Routinator vulnerabilities
CVEs whose affected-version data names the Routinator package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
10 CVEsRSS
CVE-2026-72755Low· 3.8Routinator stores TA certificate in cache without validation
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.
CVE-2026-72753High· 8.2Routinator incorrectly handles delta updates
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
CVE-2026-72756High· 7.5Routinator exits on malformed rsync URIs
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
CVE-2026-72754High· 7.5Routinator exits when parsing an incorrect or very large CRL file
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
CVE-2026-72752Medium· 6.5Routinator exits when requesting the output repeatedly
Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs…
CVE-2026-72757Medium· 5.3Routinator HTTP server becomes unavailable with many unclosed connections
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of co…
CVE-2026-72758High· 7.5Routinator may exit on malformed ranges
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
CVE-2026-49233HighRoutinator has cache path traversal when processing the module component of rsync URIs
Routinator has cache path traversal when processing the module component of rsync URIs
CVE-2026-49235HighRoutinator crashes when encountering maliciously crafted RRDP XML files
Routinator crashes when encountering maliciously crafted RRDP XML files
CVE-2026-49234High· 7.5Routinator crashes when sending a maliciously crafted select-asn query parameter
Routinator crashes when sending a maliciously crafted select-asn query parameter