CVE-2026-49234
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Jun 8, 2026
CISA due date
—
The record
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | routinator | 0 | 0.15.2 |
Related vulnerabilities
- GHSA-gc6q-cwcj-3vh9 Routinator crashes when sending a maliciously crafted select-asn query parameter Same vulnerability
- GHSA-33mj-99mg-8g73 Routinator has cache path traversal when processing the module component of rsync URIs Also affects routinator
- GHSA-5qf9-cf9c-hjc6 Routinator crashes when encountering maliciously crafted RRDP XML files Also affects routinator
- CVE-2026-49235 When Routinator encounters a file via RRDP using a specifically crafted Document Type… Also affects routinator
- CVE-2026-49233 Routinator does not properly check the module component of rsync URIs, which are used to… Also affects routinator