Juniper Junos OS: Denial of service in rpd via malformed BGP EVPN update

Summary

A length-handling flaw (CWE-130) in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker send a specially malformed BGP EVPN multicast update that is readvertised, causing an rpd crash. The impact is a routing outage (denial of service), with no direct data access. The issue only applies when BGP EVPN signaling is configured, and the attacker needs a BGP session with the device or a peer that relays the update.

Affected

• Junos OS: before 23.2R2-S7.7; 23.4 before 23.4R2-S8.13; 24.2 before 24.2R2-S5.5; 24.4 before 24.4R2-S5; 25.2 before 25.2R2-S2; 25.4 before 25.4R1-S3; 26.2 before 26.2R1-S2
• Junos OS Evolved: before 23.2R2-S7.7-EVO; 23.4 before 23.4R2-S8.11-EVO; 24.2 before 24.2R2-S5.6-EVO; 24.4 before 24.4R2-S5-EVO; 25.2 before 25.2R2-S2-EVO; 25.4 before 25.4R1-S3-EVO; 26.2 before 26.2R1-S2-EVO; plus further Evolved trains listed in the advisory
• Required configuration: protocols bgp group <group> family evpn signaling
• Versions differ between sources; verify against JSA112187.

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Fixes are part of a bundle that also addresses over 60 other routing and management bugs.

Workaround

• If EVPN multicast updates are not required, filter them with an import policy on the affected BGP peers (policy-options policy-statement EVPN-NO-MCAST with terms rejecting family evpn and nlri-route-type 6, 7, 8, 10; applied under protocols bgp group <group> import).
• Test first: blocking EVPN multicast route types can break multicast EVPN services.
• Unverified: a temporary measure of disabling BGP EVPN signaling is reported by a secondary source only; confirm it in JSA112187.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation of this vulnerability (statement covers the bundle).
• No public proof-of-concept found.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS 0.00381 (secondary source).
• Not confirmed as listed in CISA KEV.

Our recommendation

• Check whether any Junos OS or Junos OS Evolved device runs BGP EVPN signaling and whether its version falls in an affected range.
• Upgrade to a fixed release listed in JSA112187, planned with your provider or vendor.
• If an upgrade is not possible right away, apply the import policy after testing it in a lab.
• Restrict BGP sessions to trusted peers and monitor for unexpected rpd restarts and routing outages.
• Recheck NVD and CISA KEV for updates, since NVD analysis was pending at publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE: CVE-2026-101962 app.opencve.io
• Strix AI: CVE-2026-101962 www.strix.ai
• ThreatInt: CVE-2026-101962 cve.threatint.com
• Vulners (CIRCL): CVE-2026-101962 vulners.com
• SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:55.