CVE-2026-72758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72758", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-08-10T14:08:41.336Z", "datePublished": "2026-10-26T17:07:14.740Z", "dateUpdated": "2026-10-26T17:57:33.250Z"}, "containers": {"cna": {"title": "Routinator may exit on malformed ranges", "datePublic": "2026-10-26T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Routinator", "versions": [{"version": "0.15.3", "status": "unaffected", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed in 0.15.3 and all later versions."}], "timeline": [{"time": "2026-05-29T00:00:00.000Z", "lang": "en", "value": "Issue reported"}, {"time": "2026-10-26T00:00:00.000Z", "lang": "en", "value": "Fixes released"}], "credits": [{"lang": "en", "value": "Qifan Zhang, Palo Alto Networks", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-10-26T17:07:14.740Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T17:46:28.407742Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T17:57:33.250Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T17:46:28.407742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T17:49:44.445Z"}}], "cna": {"title": "Routinator may exit on malformed ranges", "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang, Palo Alto Networks"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Routinator", "versions": [{"status": "unaffected", "version": "0.15.3", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-29T00:00:00.000Z", "value": "Issue reported"}, {"lang": "en", "time": "2026-10-26T00:00:00.000Z", "value": "Fixes released"}], "solutions": [{"lang": "en", "value": "This issue is fixed in 0.15.3 and all later versions."}], "datePublic": "2026-10-26T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-10-26T17:07:14.740Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72758", "state": "PUBLISHED", "dateUpdated": "2026-10-26T17:57:33.250Z", "dateReserved": "2026-08-10T14:08:41.336Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-10-26T17:07:14.740Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Routinator", "vendor": "NLnet Labs", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0.15.3", "versionType": "semver"}]}], "source": "sep@nlnetlabs.nl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory."}], "id": "CVE-2026-72758", "lastModified": "2026-10-26T18:35:08.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "sep@nlnetlabs.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72758", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T17:46:28.407742Z", "version": "2.0.3"}}]}, "published": "2026-10-26T18:18:42.850", "references": [{"source": "sep@nlnetlabs.nl", "url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt"}], "sourceIdentifier": "sep@nlnetlabs.nl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "sep@nlnetlabs.nl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0.15.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Routinator", "source": "cna", "vendor": "NLnet Labs"}, "product": "routinator", "vendor": "nlnetlabs"}], "created": "2026-10-26T18:45:14.270949+00:00", "updated": "2026-10-26T19:00:08.308563+00:00", "vendors": ["nlnetlabs", "nlnetlabs$PRODUCT$routinator"]}