IT SBIT Services
Schneeberger
DEEN
CVE tracker

Junos OS: Denial of service in rpd via EVPN BGP route processing

CVE-2026-101945High 8.7

← All vulnerabilities

Summary

An integer overflow in the routing daemon (rpd) of Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering to cause a denial of service. Successful exploitation can disrupt control-plane adjacencies on EVPN-enabled routing instances. The official CVE record rates the issue as high severity (CVSS 4.0: 8.7), and the attacker must already be a BGP peer.

Affected

  • Junos OS: versions before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2 (default configuration unaffected)
  • Junos OS Evolved: versions before 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO
  • Only relevant with EVPN BGP enabled
  • Version list taken from the CVE record and mirrors; verify against the vendor advisory

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later

Workaround

Unknown. The CVE record states there are no known workarounds.

Exploitation

  • Juniper SIRT is not aware of malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof of concept found in research; not listed in CISA KEV at time of research.

Our recommendation

  • Check whether any device runs EVPN BGP; if not, the risk is lower, but schedule the update.
  • Patch affected Junos OS and Junos OS Evolved devices to the fixed releases in Juniper advisory JSA112187.
  • Until patched, restrict EVPN BGP peerings to known neighbours and limit access to the control plane.
  • Prioritise J-Web exposure in the same bulletin (CVE-2026-101954, CVE-2026-101986), which carries higher risk.
  • Monitor the vendor advisory and NVD for updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:56.

Original description (NVD)

An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed