The vulnerability arises when a specially crafted non‑UTF‑8 ASN string is supplied as the select‑asn query parameter to the /api/v1/origins API endpoint. This input causes the Routinator process to crash, leading to a denial of service for users running the affected version of the software. The flaw is a classic example of improper input validation (CWE‑20).

Affected is the NLnet Labs Routinator tool. Versions prior to 0.15.2 are impacted, as the issue was fixed in 0.15.2 and subsequent releases. The problem only manifests when API access is enabled and exposed to networks that are not trusted, so owners who restrict API traffic to internal or trusted networks are excluded from the risk.

With a CVSS score of 8.2 the vulnerability is rated high severity. The EPSS score is <1%, indicating a very low probability of exploitation. It is not listed in CISA's KEV catalog, but the flaw can be exploited by an attacker who can send HTTP requests to the vulnerable endpoint from an untrusted network. The exploitation would result in a crash without giving the attacker further privileges or data. Therefore, the risk is confined to availability loss for the affected system, yet the potential impact on a public‑facing API warrants swift remediation.