# CVE-2026-49234: NLnet Labs Routinator denial of service via malformed ASN query parameter

Source: https://junglewise.ai/threats/cve-2026-49234-nlnet-labs-routinator-denial-of-service-via-malformed-asn-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-49234 · Severity: high · CVSS 7.5 · Published 2026-06-08

NLnet Labs Routinator, a tool used by network operators to verify Internet routing information, is vulnerable to a denial-of-service attack. By sending a specially crafted request to the software's management interface, an attacker can cause the application to crash. This disrupts the ability to validate routing data, potentially impacting the stability and security of network routing operations if the interface is exposed to untrusted users.

Technologies: [routinator (crates.io)](https://junglewise.ai/threats/technologies/crates-io-routinator), [NLnet Labs Routinator](https://junglewise.ai/threats/technologies/routinator). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [NLnet Labs](https://junglewise.ai/threats/vendors/nlnet-labs).

## Quick answers

**Is CVE-2026-49234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49234 being exploited in the wild.

**How severe is CVE-2026-49234?** High severity, with a CVSS score of 7.5, published 8 June 2026.

**Which products and versions are affected?** routinator (crates.io) SEMVER:introduced=0,fixed=0.15.2; NLnet Labs Routinator <= 0.15.1, up to and including 0.15.1.

**Is there a fix for CVE-2026-49234?** Yes. routinator (crates.io): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49234 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49234?** Check whether you run routinator (crates.io) or NLnet Labs Routinator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- routinator (crates.io): upgrade to 0.15.2 or later

  ```sh
  cargo update -p routinator
  ```


## Technical details

A vulnerability in NLnet Labs Routinator up to version 0.15.1 is caused by improper input validation of the 'select-asn' query parameter at the /api/v1/origins endpoint. When the application receives a specifically crafted non-UTF-8 string in this parameter, it triggers a panic (crash) during string parsing. The attack can be executed remotely without authentication if the API endpoint is reachable over the network. This results in a complete loss of availability for the Routinator service. The issue is resolved in version 0.15.2.

## Affected products

- NLnet Labs Routinator <= 0.15.1

## Identifiers

- CVE-2026-49234
- GHSA-gc6q-cwcj-3vh9

## Timeline

- 2026-06-08: disclosed
- 2026-06-08: patched: Released in version 0.15.2
- 2026-06-08: advisory

## References

- [https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt](https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt)
- [https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2](https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2)

## Related threats

- [Routinator AS range parsing memory exhaustion](https://junglewise.ai/threats/cve-2026-72758-when-parsing-an-as-range-in-routinator-if-the-maximum-value-of)
- [Routinator HTTP server denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-72757-routinator-runs-out-of-open-connections-on-the-http-server-when)
- [Routinator denial of service from malformed rsync URIs](https://junglewise.ai/threats/cve-2026-72756-routinator-exits-when-an-rsync-uri-for-a-file-obtained-over-rrdp)
- [Routinator CRL parsing denial of service](https://junglewise.ai/threats/cve-2026-72754-when-routinator-encounters-a-crl-with-many-entries-it-may-hang-or)
- [Routinator improper RRDP delta entry validation](https://junglewise.ai/threats/cve-2026-72753-when-routinator-encounters-an-rrdp-notification-file-with-gaps-in)