{"id":"CVE-2026-72758","aliases":[],"cve":{"records":[{"id":"CVE-2026-72758","source":"NLnet Labs","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-10T14:08:41.336Z","published":"2026-10-26T17:07:14.740Z","modified":"2026-10-26T17:57:33.250Z"}],"publishers":[{"name":"NLnet Labs","role":"CNA","organizationId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","modified":"2026-10-26T17:07:14.740Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T17:57:33.250Z"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt","tags":["vendor-advisory"],"source":"NLnet Labs"}],"weaknesses":[{"id":"CWE-755","description":"CWE-755 Improper Handling of Exceptional Conditions","source":"NLnet Labs"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T17:46:28.407742Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Routinator may exit on malformed ranges","titleSource":"NLnet Labs","descriptionSource":"NLnet Labs","description":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.","score":7.5,"severity":"high","published":"2026-10-26T17:07:14.740Z","modified":"2026-10-26T17:57:33.250Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"NLnet Labs","name":"Routinator","platforms":[],"versions":[{"version":"0.15.3","status":"unaffected","lessThan":"*","versionType":"semver"}],"defaultStatus":"affected","cpes":[],"source":"NLnet Labs","url":"https://www.cve.org/CVERecord?id=CVE-2026-72758"}],"remediation":[{"text":"This issue is fixed in 0.15.3 and all later versions.","source":"NLnet Labs","url":"https://www.cve.org/CVERecord?id=CVE-2026-72758"}],"references":["https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt"],"sources":[{"name":"CVE","id":"CVE-2026-72758","modified":"2026-10-26T17:57:33.250Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-72758"}],"assessments":[{"source":"NLnet Labs","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T14:44:12.564Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:50:31.946Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Routinator may exit due to a malformed AS range with a maximum value smaller than the minimum, causing it to run out of memory. The issue is reportedly fixed in version 0.15.3 and later. Affected versions are not explicitly stated.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:25:51.638Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-72758"}]}}