The CVE number for this vulnerability is CVE-2026-72752.

== Summary
Routinator exits when requesting the output repeatedly

== Affected products
Routinator up to and including 0.15.2.

== Description
Routinator runs out of memory when the JSON output is requested many times
concurrently. This condition can be triggered maliciously by an attacker
by opening a large number of connections to the HTTP server. Additionally
Routinator runs into a stack overflow and exits when a payload item with
too much metadata is discarded at once.

This only affects users that make their HTTP or RTR server available to
untrusted networks.

== Solution
Install Routinator 0.15.3 or later.

== Acknowledgments
We would like to thank Qifan Zhang, Palo Alto Networks for finding
the vulnerability.