{"api_version":"1","generated_at":"2026-10-27T14:38:22+00:00","cve":"CVE-2026-72758","urls":{"html":"https://cve.report/CVE-2026-72758","api":"https://cve.report/api/cve/CVE-2026-72758.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72758","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72758"},"summary":{"title":"Routinator may exit on malformed ranges","description":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.","state":"PUBLISHED","assigner":"NLnet Labs","published_at":"2026-10-26 18:18:42","updated_at":"2026-10-26 18:35:08"},"problem_types":["CWE-755","CWE-755 CWE-755 Improper Handling of Exceptional Conditions"],"metrics":[{"version":"3.1","source":"sep@nlnetlabs.nl","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt","name":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt","refsource":"sep@nlnetlabs.nl","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72758","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72758","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"NLnet Labs","product":"Routinator","version":"unaffected 0.15.3 * semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-05-29T00:00:00.000Z","lang":"en","value":"Issue reported"},{"source":"CNA","time":"2026-10-26T00:00:00.000Z","lang":"en","value":"Fixes released"}],"solutions":[{"source":"CNA","title":"","value":"This issue is fixed in 0.15.3 and all later versions.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Qifan Zhang, Palo Alto Networks","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72758","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-26T17:46:28.407742Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-26T17:57:33.250Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"affected","product":"Routinator","vendor":"NLnet Labs","versions":[{"lessThan":"*","status":"unaffected","version":"0.15.3","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Qifan Zhang, Palo Alto Networks"}],"datePublic":"2026-10-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-755","description":"CWE-755 Improper Handling of Exceptional Conditions","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-26T17:07:14.740Z","orgId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","shortName":"NLnet Labs"},"references":[{"tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt"}],"solutions":[{"lang":"en","value":"This issue is fixed in 0.15.3 and all later versions."}],"timeline":[{"lang":"en","time":"2026-05-29T00:00:00.000Z","value":"Issue reported"},{"lang":"en","time":"2026-10-26T00:00:00.000Z","value":"Fixes released"}],"title":"Routinator may exit on malformed ranges","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"206fc3a0-e175-490b-9eaa-a5738056c9f6","assignerShortName":"NLnet Labs","cveId":"CVE-2026-72758","datePublished":"2026-10-26T17:07:14.740Z","dateReserved":"2026-08-10T14:08:41.336Z","dateUpdated":"2026-10-26T17:57:33.250Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-26 18:18:42","lastModifiedDate":"2026-10-26 18:35:08","problem_types":["CWE-755","CWE-755 CWE-755 Improper Handling of Exceptional Conditions"],"metrics":{"cvssMetricV31":[{"source":"sep@nlnetlabs.nl","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-26T17:46:28.407742Z","id":"CVE-2026-72758","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72758","Ordinal":"1","Title":"Routinator may exit on malformed ranges","CVE":"CVE-2026-72758","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72758","Ordinal":"1","NoteData":"When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.","Type":"Description","Title":"Routinator may exit on malformed ranges"}]}}}