Quick answers
- Is CVE-2026-72757 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72757 being exploited in the wild.
- How severe is CVE-2026-72757?
- Medium severity, with a CVSS score of 5.3, published 26 October 2026.
- Which products and versions are affected?
- NLnet Labs Routinator up to and including 0.15.2.
- Is there a fix for CVE-2026-72757?
- No fixed version is recorded yet. Restrict access to the HTTP and RTR servers to trusted networks only, such as through network-level access controls or firewall rules that limit which external hosts can connect. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-72757 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-72757?
- Check whether you run NLnet Labs Routinator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict access to the HTTP and RTR servers to trusted networks only, such as through network-level access controls or firewall rules that limit which external hosts can connect.
Technical details
The HTTP server in Routinator fails to properly limit or manage concurrent connections, allowing an attacker to exhaust available file descriptors through connection flooding. This is a resource exhaustion attack that requires network access to the HTTP server. The attacker can trigger unavailability by opening a large number of connections and leaving them open without sending valid requests.
Affected products
- NLnet Labs Routinator up to and including 0.15.2
Timeline
- 2026-10-26: disclosed