Executive brief
NLnet Labs Routinator, a tool used by network operators to verify Internet routing information, is vulnerable to a denial-of-service attack. By sending a specially crafted request to the software's management interface, an attacker can cause the application to crash. This disrupts the ability to validate routing data, potentially impacting the stability and security of network routing operations if the interface is exposed to untrusted users.
Technical details
A vulnerability in NLnet Labs Routinator up to version 0.15.1 is caused by improper input validation of the 'select-asn' query parameter at the /api/v1/origins endpoint. When the application receives a specifically crafted non-UTF-8 string in this parameter, it triggers a panic (crash) during string parsing. The attack can be executed remotely without authentication if the API endpoint is reachable over the network. This results in a complete loss of availability for the Routinator service. The issue is resolved in version 0.15.2.
Affected products
- NLnet Labs Routinator <= 0.15.1
Timeline
- 2026-06-08: disclosed
- 2026-06-08: patched: Released in version 0.15.2
- 2026-06-08: advisory