Which versions of Routinator are affected by CVE-2026-49234?

NLnet Labs Routinator, critical RPKI infrastructure software, is vulnerable to remote denial-of-service attacks that can crash the daemon through its HTTP API.. A patch is available.

How to fix or mitigate CVE-2026-49234?

Within 24 hours: audit network access to the /api/v1/origins endpoint and restrict to trusted sources only; disable public API exposure if not operationally required. Within 7 days: monitor NLnet Labs advisories and vendor channels for patch availability; evaluate feasibility of deploying Routinator behind a WAF or reverse proxy with UTF-8 validation and request filtering. Within 30 days: apply vendor patch immediately upon release, or implement permanent network-level controls (firewall rules, VPN-gated access) to restrict API access to internal networks.

Routinator CVE-2026-49234

Q: What is the CVSS score of CVE-2026-49234?

CVE-2026-49234 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35064 HIGH

Improper Input Validation (CWE-20)

2026-06-08 NLnet Labs

GHSA-gc6q-cwcj-3vh9

Denial Of Service Routinator

8.2

CVSS 4.0 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

8.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NLnet Labs) · only source for this CVE.

CVSS VectorVendor: NLnet Labs

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:50 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

8.2 (HIGH)

CVE Published

Jun 08, 2026 - 12:58 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes.

This only affects users who allow API access from untrusted networks.

AnalysisAI

Denial of service in NLnet Labs Routinator (an RPKI Relying Party software) allows remote attackers to crash the daemon by sending a specifically crafted non-UTF-8 string in the select-asn query parameter to the /api/v1/origins HTTP endpoint. The flaw only impacts deployments that expose the API to untrusted networks, and no public exploit has been identified at time of analysis. CVSS 4.0 base score is 8.2 driven by high availability impact to both the vulnerable component and downstream RPKI consumers.

Technical ContextAI

Routinator is NLnet Labs' RPKI (Resource Public Key Infrastructure) Relying Party validator written in Rust, responsible for fetching and validating ROAs used by routers and route servers to make BGP origin-validation decisions. The bug is rooted in CWE-20 (Improper Input Validation): the /api/v1/origins endpoint accepts a select-asn query parameter but does not safely handle byte sequences that are not valid UTF-8, causing the process to panic and terminate. Because RPKI validation feeds downstream BGP routers via RTR, an outage of the validator can degrade ROV decisions for every router relying on this instance, which is reflected in the CVSS Subsequent System Availability (SA:H) metric.

RemediationAI

Vendor-released patch: Routinator 0.15.2 - upgrade immediately per the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt. Until the upgrade can be applied, restrict access to the HTTP API by binding it to localhost only or placing it behind a reverse proxy/firewall ACL that permits only trusted management hosts; specifically block external reachability of /api/v1/origins. As an additional compensating control, front the endpoint with a proxy that validates query parameters as UTF-8 before forwarding, accepting the trade-off that legitimate ASN selection requests must still pass through unchanged. Monitor the Routinator process for unexpected restarts and configure a supervisor (systemd Restart=on-failure) so an exploitation attempt produces a brief blip rather than a sustained validator outage, with the side effect that repeated crashes may mask attack activity in logs.