Description
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.

This only affects users that make their HTTP or RTR server available to untrusted networks.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

This issue is fixed in 0.15.3 and all later versions.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. This only affects users that make their HTTP or RTR server available to untrusted networks.
Title Routinator HTTP server becomes unavailable with many unclosed connections
Weaknesses CWE-755
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-10-26T17:57:33.452Z

Reserved: 2026-08-10T14:08:41.336Z

Link: CVE-2026-72757

cve-icon Vulnrichment

Updated: 2026-10-26T17:49:49.790Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T18:18:42.507

Modified: 2026-10-26T18:35:08.450

Link: CVE-2026-72757

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses