GHSA-gc6q-cwcj-3vh9

Source

https://github.com/advisories/GHSA-gc6q-cwcj-3vh9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gc6q-cwcj-3vh9/GHSA-gc6q-cwcj-3vh9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gc6q-cwcj-3vh9

Aliases

CVE-2026-49234

Published

2026-06-08T15:33:00Z

Modified

2026-06-12T19:15:18.112742248Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
8.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator

Summary

Routinator crashes when sending a maliciously crafted select-asn query parameter

Details

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes.

This only affects users who allow API access from untrusted networks.

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "github_reviewed_at": "2026-06-12T19:06:21Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "nvd_published_at": "2026-06-08T15:16:48Z"
}

References

Affected packages

crates.io / routinator

Package

Name: routinator; View open source insights on deps.dev
Purl: pkg:cargo/routinator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.15.2

Database specific

last_known_affected_version_range

"<= 0.15.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gc6q-cwcj-3vh9/GHSA-gc6q-cwcj-3vh9.json"