GitHub Advisoryadvisory · crates.io

GHSA-gc6q-cwcj-3vh9 Routinator crashes when sending a maliciously crafted select-asn query parameter

HIGH Published 2026-06-08 Modified 2026-06-12 Official page ↗
Aliases
CVE-2026-49234
Ecosystem
crates.io
Packages
routinator
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2026-06-12

Affected packages

• crates.io routinator: < 0.15.2 → fixed in 0.15.2

Description

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

Related

Alias · CVE (1)

  • CVE-2026-49234 When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References