Vulnerability · Published Jun 8, 2026 · Assigned by NLnet Labs
CVE-2026-49234Routinator crashes on specifically crafted ASN strings in the API
High 8.2
In plain English
A high-severity improper input validation in Routinator from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Routinator | see references |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
References
- https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt vendor-advisory