Junos OS and Junos OS Evolved: Denial of service in rpd via BGP EVPN
Summary
Junos OS and Junos OS Evolved versions in the affected ranges are vulnerable to an incorrect calculation in the routing protocol daemon (rpd). A remote BGP EVPN neighbor can crash rpd and interrupt routing, which is a denial of service. The issue only occurs when SRv6 EVPN multihoming is configured and the peer can establish a BGP EVPN session, so it is mainly relevant for service provider and data centre fabrics.
Affected
- Junos OS: 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2 (default configuration unaffected)
- Junos OS Evolved: 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, 23.4X100, 25.2X100 before 25.2X100-D35-EVO, 25.4X300 before 25.4X300-D40-EVO (default configuration unaffected)
- Required configuration: protocols bgp <group> family evpn signaling accept-srv6-service and routing-options transport-class name <class> color <color>
Fixed in
- Junos OS: 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
- Junos OS Evolved: 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all later releases
- 23.4X100: no fixed release listed in the CVE record. Unknown.
Workaround
Juniper SIRT lists no known workarounds. Unconfirmed mitigation from secondary sources: restrict BGP EVPN peers to trusted sessions and consider disabling SRv6 EVPN multihoming until patched. Verify against JSA112187 before relying on it.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found.
- EPSS score 0.00445.
Our recommendation
- Check whether any Junos or Junos OS Evolved device (for example MX, PTX, QFX, ACX) uses EVPN with SRv6 multihoming. Ask your provider if unsure.
- If affected, plan the fixed release from JSA112187 for the next maintenance window and review the other rpd issues in the same bulletin at the same time.
- Until patched, limit BGP EVPN peers to trusted sessions and monitor for rpd restarts and crash files.
- If no EVPN-SRv6 setup exists, the priority is low; document this and confirm with a configuration check.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112187 supportportal.juniper.net
- OpenCVE: CVE-2026-101963 app.opencve.io
- Threatint: CVE-2026-101963 cve.threatint.com
- VulDB: CVE-2026-101963 vuldb.com
- Vulners VulnRichment: CVE-2026-101963 vulners.com
- Strix: CVE-2026-101963 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:56.
Original description (NVD)
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.