CVE-2026-49234

🗓️ 08 Jun 2026 12:58:58Reported by NLnet LabsType

cve🔗 web.nvd.nist.gov👁 25 Views🌐 WEB

Routinator crashes on crafted non-UTF-8 select-asn string to /api/v1/origins, affecting untrusted networks.

Reporter	Title	Published	Views	Family All 13
FreeBSD	Routinator -- CWE-20 Improper Input Validation	8 Jun 202600:00	–	freebsd
ATTACKERKB	CVE-2026-49234	8 Jun 202612:58	–	attackerkb
Circl	CVE-2026-49234	8 Jun 202615:44	–	circl
CNNVD	NLnet Labs Routinator 输入验证错误漏洞	8 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-49234 Routinator crashes on specifically crafted ASN strings in the API	8 Jun 202612:58	–	cvelist
EUVD	EUVD-2026-35064	8 Jun 202612:58	–	euvd
Tenable Nessus	FreeBSD : Routinator -- CWE-20 Improper Input Validation (40edfb37-6a59-11f1-bf61-3c7c3fba4204)	20 Jun 202600:00	–	nessus
Github Security Blog	Routinator crashes when sending a maliciously crafted select-asn query parameter	8 Jun 202615:33	–	github
NVD	CVE-2026-49234	8 Jun 202615:16	–	nvd
OSV	GHSA-GC6Q-CWCJ-3VH9 Routinator crashes when sending a maliciously crafted select-asn query parameter	8 Jun 202615:33	–	osv

NVD

Node

nlnetlabs routinatorRange<0.15.2

[
  {
    "vendor": "NLnet Labs",
    "product": "Routinator",
    "versions": [
      {
        "version": "0.15.2",
        "status": "unaffected",
        "lessThan": "*",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
nlnetlabs	www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt

Parameter	Position	Path	Description	CWE
select-asn	query param	/api/v1/origins	Non-UTF-8 input in the select-asn query parameter can crash the API endpoint.	CWE-20

17 Jun 2026 10:55Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

CVSS 48.2

EPSS0.00259

SSVC

CWE-20