CVE-2026-49232

The record

Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP or RTR server. This only affects users that make their HTTP or RTR server available to untrusted networks.

Affected packages

Related vulnerabilities

• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
• CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
• CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
• CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755
• CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on… CWE-755
• CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game server… CWE-755
• CVE-2026-59952 Valibot helps validate data using a schema. CWE-755