Is CVE-2026-49235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49235 being exploited in the wild.

How severe is CVE-2026-49235?

High severity, with a CVSS score of 4, published 8 June 2026.

Which products and versions are affected?

routinator (crates.io) SEMVER:introduced=0,fixed=0.15.2; NLnet Labs Routinator <= 0.15.1, up to and including 0.15.1.

Is there a fix for CVE-2026-49235?

Yes. routinator (crates.io): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49235 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49235?

Check whether you run routinator (crates.io) or NLnet Labs Routinator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49235: NLnet Labs Routinator denial of service via crafted RRDP DTD

Q: Is there a fix for CVE-2026-49235?

Yes. routinator (crates.io): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49235 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49235?

Check whether you run routinator (crates.io) or NLnet Labs Routinator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49235 · Severity: high · CVSS 4 · Published 2026-06-08

NLnet Labs Routinator, a software tool used to verify the validity of Internet routing data, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted XML file through the RPKI Repository Delta Protocol (RRDP) that causes the software to crash. This could disrupt the ability of network operators to validate routing information, potentially impacting the stability of Internet routing for the affected organization.

Technologies: routinator (crates.io), NLnet Labs Routinator. Vendors: crates.io, NLnet Labs.

Quick answers

Is CVE-2026-49235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49235 being exploited in the wild.
How severe is CVE-2026-49235?: High severity, with a CVSS score of 4, published 8 June 2026.
Which products and versions are affected?: routinator (crates.io) SEMVER:introduced=0,fixed=0.15.2; NLnet Labs Routinator <= 0.15.1, up to and including 0.15.1.
Is there a fix for CVE-2026-49235?: Yes. routinator (crates.io): upgrade to 0.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49235 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49235?: Check whether you run routinator (crates.io) or NLnet Labs Routinator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

routinator (crates.io): upgrade to 0.15.2 or later
```
cargo update -p routinator
```

Technical details

A vulnerability exists in Routinator (specifically within its XML parsing dependency, quick-xml) where processing a maliciously crafted Document Type Definition (DTD) via the RPKI Repository Delta Protocol (RRDP) leads to a panic/crash. The issue is categorized as Uncontrolled Resource Consumption (CWE-400) and Improper Restriction of Recursive Entity References (CWE-776), commonly known as an XML Entity Expansion or 'billion laughs' style attack. An unauthenticated remote attacker can trigger this by hosting a malicious RRDP repository that the Routinator instance attempts to synchronize. The vulnerability is resolved by upgrading to Routinator 0.15.2, which incorporates quick-xml version 0.39.4 or later.

Affected products

NLnet Labs Routinator <= 0.15.1

Identifiers

CVE-2026-49235
GHSA-5qf9-cf9c-hjc6

Timeline

2026-06-08: disclosed
2026-06-08: patched: Released in version 0.15.2
2026-06-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.