{"id":"CVE-2026-72758","state":"PUBLISHED","title":"Routinator may exit on malformed ranges","description":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.","publishedAt":"2026-10-26T17:07:14.740Z","updatedAt":"2026-10-26T17:57:33.250Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"NLnet Labs"},"assigner":"NLnet Labs","products":["NLnet Labs Routinator"],"affected":[{"vendor":"NLnet Labs","product":"Routinator","defaultStatus":"affected","versions":[{"version":"0.15.3","status":"unaffected","lessThan":"*","versionType":"semver"}]}],"references":["https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt"],"weaknesses":["CWE-755"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72758.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72758","state":"PUBLISHED","datePublished":"2026-10-26T17:07:14.740Z","dateUpdated":"2026-10-26T17:57:33.250Z","assignerShortName":"NLnet Labs","assignerOrgId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","dateReserved":"2026-08-10T14:08:41.336Z"},"containers":{"cna":{"title":"Routinator may exit on malformed ranges","descriptions":[{"lang":"en","value":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory."}],"affected":[{"vendor":"NLnet Labs","product":"Routinator","defaultStatus":"affected","versions":[{"version":"0.15.3","status":"unaffected","lessThan":"*","versionType":"semver"}]}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-755","lang":"en","description":"CWE-755 Improper Handling of Exceptional Conditions","type":"CWE"}]}],"providerMetadata":{"shortName":"NLnet Labs","orgId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","dateUpdated":"2026-10-26T17:07:14.740Z"},"datePublic":"2026-10-26T00:00:00.000Z","solutions":[{"lang":"en","value":"This issue is fixed in 0.15.3 and all later versions."}],"timeline":[{"time":"2026-05-29T00:00:00.000Z","lang":"en","value":"Issue reported"},{"time":"2026-10-26T00:00:00.000Z","lang":"en","value":"Fixes released"}],"credits":[{"lang":"en","value":"Qifan Zhang, Palo Alto Networks","type":"finder"}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72758","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-26T17:46:28.407742Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-26T17:57:33.250Z"}}]}}}