Description
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes.
This only affects users who allow API access from untrusted networks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NLnet Labs | Routinator | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | routinator | < 0.15.2 | 0.15.2 | GHSA-gc6q-cwcj-3vh9 |
References
- https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt vendor-advisory