Cyber Resilience

CVE-2026-49232

HighUpdated

Published: 08 June 2026

Published
08 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0033 25.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-49232 is a high-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Nlnetlabs (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability details

Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of…

more

connections to the HTTP or RTR server. This only affects users that make their HTTP or RTR server available to untrusted networks.

CWE(s)
CWE-755

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Vulnerability enables resource exhaustion DoS via connection flood against public-facing service due to improper error handling (CWE-755).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

Nlnetlabs
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-5 Response to Audit Logging Process Failures
addresses: CWE-755

Provides defined handling (alert and additional actions) for the exceptional condition of audit logging failure.

CP-12 Safe Mode
addresses: CWE-755

Supplies a concrete handling action (safe mode) for exceptional conditions, mitigating risks from improper or absent handling that could allow continued attacks.

CP-3 Contingency Training
addresses: CWE-755

By preparing users for contingency scenarios, the control promotes proper handling of exceptional conditions instead of default or unsafe behaviors.

CP-5 Contingency Plan Update
addresses: CWE-755

An updated contingency plan defines current actions for exceptional conditions, reducing the window for attackers to exploit improper handling leading to system failure.

IR-1 Policy and Procedures
addresses: CWE-755

Procedures ensure proper handling of exceptional conditions to support effective incident response.

IR-3 Incident Response Testing
addresses: CWE-755

Incident response testing confirms proper handling of exceptional conditions to limit exploit impact.

IR-7 Incident Response Assistance
addresses: CWE-755

Gives users guidance on incident handling, reducing improper handling of exceptional conditions that could stem from exploited weaknesses.

SC-24 Fail in Known State
addresses: CWE-755

Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state.

References