IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Denial of service in rpd via malformed EVPN routes

CVE-2026-101942High 8.7

← All vulnerabilities

Summary

Juniper Junos OS and Junos OS Evolved contain a flaw in the routing protocol daemon (rpd). A malformed EVPN Type-3 or Type-4 route, received from a configured EVPN peer, crashes rpd when it is processed for re-advertisement, which causes a denial of service. An unauthenticated network attacker needs to be an EVPN peer or control one, so the risk is mainly for networks that use EVPN signalling. The CVE record states no impact on confidentiality or integrity.

Affected

  • Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2
  • Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; 23.4X100; 25.2X100 to < 25.2X100-D35-EVO; 25.4X300 to < 25.4X300-D40-EVO
  • Default configuration: not affected according to the CVE record

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
  • Releases 23.2, 23.4 and 24.2 (and the Evolved equivalents) have been respun; use the rebuilt versions named in the advisory

Workaround

No known workarounds (according to Juniper SIRT).

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

  • Check whether any Junos OS or Junos OS Evolved device uses EVPN and list its EVPN peers.
  • Read advisory JSA112187 on the Juniper support portal and compare the affected versions with your devices.
  • Update affected devices to a fixed release, or the rebuilt respin, as soon as possible. Plan the update for the whole advisory, as it covers several related rpd issues.
  • Restrict BGP and EVPN sessions to trusted peers and networks until patched.
  • Monitor rpd crashes and unexpected routing changes on affected devices.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:01.

Original description (NVD)

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed