High severity · published Jun 8, 2026
CVE-2026-49232
Routinator exits when accepting an incoming HTTP or RTR connection fails
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP or RTR server.
This only affects users that make their HTTP or RTR server available to untrusted networks.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routinator · NLnet Labs
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49232
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49232
www.nlnetlabs.nl
https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49232.txt
More from Routinator
8.2
CVE-2026-72753
Routinator incorrectly handles delta updates
7.5
CVE-2026-72758
Routinator may exit on malformed ranges
7.5
CVE-2026-72756
Routinator exits on malformed rsync URIs
7.5
CVE-2026-72754
Routinator exits when parsing an incorrect or very large CRL file
7.5
CVE-2026-49235
Routinator crashes on specifically crafted RRDP XML files