CVE-2026-49235 - Vulnerability Details - OpenCVE

When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt

History

Mon, 08 Jun 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 08 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Description		When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.
Title		Routinator crashes on specifically crafted RRDP XML files
Weaknesses		CWE-755
References		https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published: 2026-06-08T12:59:09.249Z

Updated: 2026-06-08T15:40:07.732Z

Reserved: 2026-05-28T08:28:56.664Z

Link: CVE-2026-49235

Vulnrichment

Updated: 2026-06-08T15:40:03.365Z

NVD

Status : Received

Published: 2026-06-08T15:16:48.350

Modified: 2026-06-08T15:16:48.350

Link: CVE-2026-49235

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-08T15:30:27Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49235", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "state": "PUBLISHED", "assignerShortName": "NLnet Labs", "dateReserved": "2026-05-28T08:28:56.664Z", "datePublished": "2026-06-08T12:59:09.249Z", "dateUpdated": "2026-06-08T15:40:07.732Z"}, "containers": {"cna": {"title": "Routinator crashes on specifically crafted RRDP XML files", "datePublic": "2026-06-08T00:00:00.000Z", "affected": [{"vendor": "NLnet Labs", "product": "Routinator", "versions": [{"version": "0.15.2", "status": "unaffected", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions", "type": "CWE"}]}], "solutions": [{"lang": "en", "value": "This issue is fixed in 0.15.2 and all later versions."}], "timeline": [{"time": "2026-03-28T00:00:00.000Z", "lang": "en", "value": "Issue reported"}, {"time": "2026-06-08T00:00:00.000Z", "lang": "en", "value": "Fixes released"}], "credits": [{"lang": "en", "value": "X41 D-Sec GmbH", "type": "finder"}], "references": [{"url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt", "tags": ["vendor-advisory"]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-06-08T12:59:09.249Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T15:39:58.997665Z", "id": "CVE-2026-49235", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T15:40:07.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49235", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T15:39:58.997665Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T15:40:03.365Z"}}], "cna": {"title": "Routinator crashes on specifically crafted RRDP XML files", "credits": [{"lang": "en", "type": "finder", "value": "X41 D-Sec GmbH"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NLnet Labs", "product": "Routinator", "versions": [{"status": "unaffected", "version": "0.15.2", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-03-28T00:00:00.000Z", "value": "Issue reported"}, {"lang": "en", "time": "2026-06-08T00:00:00.000Z", "value": "Fixes released"}], "solutions": [{"lang": "en", "value": "This issue is fixed in 0.15.2 and all later versions."}], "datePublic": "2026-06-08T00:00:00.000Z", "references": [{"url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "shortName": "NLnet Labs", "dateUpdated": "2026-06-08T12:59:09.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49235", "state": "PUBLISHED", "dateUpdated": "2026-06-08T15:40:07.732Z", "dateReserved": "2026-05-28T08:28:56.664Z", "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6", "datePublished": "2026-06-08T12:59:09.249Z", "assignerShortName": "NLnet Labs"}, "dataVersion": "5.2"}