CVE-2026-49234

HIGH

Routinator crashes on specifically crafted ASN strings in the API

Title source: cna

Description

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt

Scores

CVSS v3 7.5

EPSS 0.0026

EPSS Percentile 17.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (3)

crates.io/routinator 0 - 0.15.2crates.io

NLnet Labs/Routinator 0.15.2

nlnetlabs/routinator < 0.15.2

Published Jun 08, 2026

Tracked Since Jun 08, 2026