Routinator vulnerabilities
4 known CVE vulnerabilities in Routinator, translated and rated.
- CVE-2026-49235High
Vulnerability in Routinator causes a crash when encountering an RRDP file with a specially crafted Document Type Definition (DTD).
- CVE-2026-49234High
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
- CVE-2026-49233High
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
- CVE-2026-49232High
Routinator exits on any error when accepting incoming HTTP or RTR connections, including recoverable ones like running out of file descriptors. An attacker can trigger this by opening many connections.