CVE-2026-49234
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
Risk Assessment
The organization is at risk of DoS attacks that can disrupt Routinator if the API is accessible from untrusted networks.
Recommendation
Restrict API access to trusted networks only and upgrade to a patched version.
Other vulnerabilities in Routinator
See all- CVE-2026-49235High
Vulnerability in Routinator causes a crash when encountering an RRDP file with a specially crafted Document Type Definition (DTD).
- CVE-2026-49233High
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
- CVE-2026-49232High
Routinator exits on any error when accepting incoming HTTP or RTR connections, including recoverable ones like running out of file descriptors. An attacker can trigger this by opening many connections.
Original NVD description (English source)
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.