CVE-2026-49234: Routinator crashes on specifically crafted ASN strings in the API

Synopsis

A denial-of-service crash affects NLnet Labs Routinator, the RPKI validator daemon. The vulnerability is reachable locally without authentication, and a crafted non-UTF-8 string sent to the /api/v1/origins endpoint causes the process to crash, disrupting both the local service and any downstream systems that depend on it. A patched-image rebuild at version 0.15.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The CVSS vector specifies AV:L, meaning the attacker needs an existing shell or process on the host rather than direct network access to the API endpoint.

• AuthenticationNot required

  No credentials or account are required to trigger the crash; the malformed query parameter can be submitted anonymously.

• Victim interactionNot required

  No user action is needed; sending a single crafted HTTP request to the endpoint is sufficient to cause the crash.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• Crashes the Routinator process, taking down RPKI route-origin validation for the host.
• Downstream routers and systems relying on Routinator for validated ROA data lose their validation feed, which can degrade BGP route security posture until the service is restarted or replaced.
• Repeated crashes can be used to sustain a denial-of-service condition if the process is automatically restarted, consuming operator attention and risking validation gaps.