CVE-2026-49232: Routinator exits when accepting an incoming HTTP or RTR connection fails

Synopsis

This is a denial-of-service vulnerability in NLnet Labs Routinator, the RPKI validator daemon. An unauthenticated remote attacker can open a large number of connections to Routinator's HTTP or RTR listener, exhausting file descriptors and causing the process to exit instead of recovering gracefully. Successful exploitation crashes the Routinator service, disrupting RPKI-based route origin validation and degrading dependent routing infrastructure. A patched-image rebuild at version 0.15.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach Routinator's HTTP or RTR listener over the network; NLnet Labs notes this only affects deployments that expose those ports to untrusted networks.

• AuthenticationNot required

  No credentials are needed; the attacker simply opens connections to the public listener without authenticating.

• Victim interactionNot required

  No user or operator action is required; the attacker triggers the crash entirely through their own connection attempts.

• Attack complexityDetail

  Exploit conditions are straightforward and require no special timing, race conditions, or environmental setup beyond network access to the listener.

Blast Radius

• The Routinator process exits, taking the RPKI validation service offline for the duration of the outage.
• Route origin validation fails for any BGP router relying on the RTR feed from this Routinator instance, leaving routing decisions without RPKI-derived ROV coverage.
• Downstream RPKI-dependent infrastructure experiences degraded protection against route hijacks for as long as the service remains down.