7.5
HighCVSS 3.1 · from NLnet Labs
CVE-2026-72756
Routinator exits on malformed rsync URIs
Routinator · CWE-755 · CWE-755AffectedRoutinator
FixUpdate to 0.15.3 or newer
PublishedOct 26, 17:06 · NLnet Labs
ScoredOct 26 · 7.5 · NLnet Labs
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.
Description
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
From NLnet Labs
Affected and fixed versions
ProductAffectedFixed inRoutinatorNot affected0.15.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known