CVE-2026-49234High· 7.5▾ TwilightRoutinator crashes when sending a maliciously crafted select-asn query parameter
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.3%
0.3% → 0.3%
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes.
This only affects users who allow API access from untrusted networks.
routinator <= 0.15.1Upgrade to a patched release:
routinator 0.15.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49233HighRoutinator has cache path traversal when processing the module component of rsync URIs
CVE-2026-49235HighRoutinator crashes when encountering maliciously crafted RRDP XML files
CVE-2026-72753High· 8.2Routinator incorrectly handles delta updates
CVE-2026-72755Low· 3.8Routinator stores TA certificate in cache without validation
CVE-2026-72752Medium· 6.5Routinator exits when requesting the output repeatedly
CVE-2026-72754High· 7.5Routinator exits when parsing an incorrect or very large CRL file