The vulnerability CVE-2026-49234 in NLnet Labs Routinator is due to improper input validation of the select-asn query parameter in the /api/v1/origins API endpoint. Specifically, sending a crafted non-UTF-8 string causes the Routinator service to crash. This can lead to denial of service conditions for affected systems. The CVSS 4.0 score is 8.2, indicating high severity, with attack vector local, low attack complexity, no privileges required, no user interaction, and high impact on availability. The issue only affects deployments where the API is accessible from untrusted networks. No patch or official fix has been published by the vendor as of the data provided.

Successful exploitation results in a crash of the Routinator service, causing denial of service. This impacts availability but does not indicate direct compromise of confidentiality or integrity. The vulnerability requires local or network access to the API endpoint and affects only configurations exposing the API to untrusted networks. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict API access to trusted networks only to prevent exposure to untrusted sources. No official fix or temporary workaround has been published by NLnet Labs at this time.