CVE-2026-49234

The flaw

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

What to do

Review advisory and patch per vendor guidance.

References