7.5
HighCVSS 3.1 · from NLnet Labs
CVE-2026-72754
Routinator exits when parsing an incorrect or very large CRL file
Routinator · CWE-755 · CWE-755AffectedRoutinator
FixUpdate to 0.15.3 or newer
PublishedOct 26, 17:06 · NLnet Labs
ScoredOct 26 · 7.5 · NLnet Labs
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.
Description
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
From NLnet Labs
Affected and fixed versions
ProductAffectedFixed inRoutinatorNot affected0.15.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known