8.2
High
CVE-2026-49234 When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint,…
Description
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Routinator 0.15 | earliest → < 0.15.2 | 0.15.2 |
References
- www.nlnetlabs.nl www.nlnetlabs.nl
Timeline
- Published
- Last modified
Other CVEs of Routinator
The 20 CVEs of Routinator →
CVE-2026-72758
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the…
7.5
High
CVE-2026-72757
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving…
5.3
Medium
CVE-2026-72756
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such…
7.5
High
CVE-2026-72755
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a…
3.8
Low