Juniper Junos OS: Denial of service in rpd via malformed BGP MCAST-TREE update

Summary

The routing protocol daemon (rpd) of Junos OS and Junos OS Evolved can crash when it receives a malformed BGP MCAST-TREE update and readvertises the NLRI. A network-adjacent, configured BGP peer can trigger this denial of service, which disrupts routing but does not expose data. The CVSS scores are inconsistent: the ticket states v4.0 8.7, while Juniper's CVE record lists 3.1 7.5, so the official score must be checked in JSA112187.

Affected

• Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2 (default configuration unaffected)
• Junos OS Evolved: 0 to before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; plus 23.4X100, 25.2X100 (before 25.2X100-D35-EVO) and 25.4X300 (before 25.4X300-D40-EVO)
• Required configuration: protocols bgp group <name> family inet-/inet6-bgpmcast signaling

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
• Releases 23.2, 23.4 and 24.2 have respins; earlier builds of these releases were rebuilt.

Workaround

Unknown. Juniper's CVE record states there are no known workarounds.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Open JSA112187 and confirm the affected and fixed releases for your devices before planning changes.
• Identify Junos OS or Junos OS Evolved routers with the BGP inet/inet6-bgpmcast family configured.
• Restrict which peers may establish these BGP sessions and use BGP authentication where possible.
• Upgrade to a fixed release; the same upgrade covers the other Juniper October 2026 bulletin items.
• Monitor for rpd restarts and crash files.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE record CVE-2026-101951 app.opencve.io
• Vulners PT-2026-113805 vulners.com
• OffSeq Radar CVE-2026-101951 radar.offseq.com
• Strix CVE-2026-101951 www.strix.ai
• SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info
• HKCERT security bulletin Juniper Junos OS www.hkcert.org
• Safeguard.sh CVE-2026-101942 (sibling CVE, rpd EVPN) safeguard.sh

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:52.