{"id":"CVE-2026-49234","aliases":["GHSA-gc6q-cwcj-3vh9"],"title":"Routinator crashes when sending a maliciously crafted select-asn query parameter","summary":"Routinator crashes when sending a maliciously crafted select-asn query parameter","severity":"high","cvss":7.5,"cwe":["CWE-20"],"vendor":"routinator","product":"routinator","ecosystem":"rust","affected":["routinator <= 0.15.1"],"patched":["routinator 0.15.2"],"published":"2026-06-08","updated":"2026-06-12","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gc6q-cwcj-3vh9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49234"},{"url":"https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt"},{"url":"https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2"},{"url":"https://github.com/advisories/GHSA-gc6q-cwcj-3vh9"}],"tags":["ghsa","rust"],"epss":0.00266,"epssPercentile":0.18791,"ingestedAt":"2026-07-07T15:41:59.873Z","slug":"CVE-2026-49234","body":"## Overview\n\nWhen sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. \n\nThis only affects users who allow API access from untrusted networks.\n\n## Affected packages\n\n- `routinator <= 0.15.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `routinator 0.15.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}