Junos OS and Junos OS Evolved: Stack-based buffer overflow in rpd via BGP flow-spec

Summary

A stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved can be triggered by a configured BGP peer. The peer sends a flow-spec update that is selected for re-advertisement, which crashes rpd. On Junos OS, the vendor states that remote code execution is also possible. The attack requires a configured BGP session with flow-spec enabled, so it is not reachable from the internet in general.

Affected

• Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
• Junos OS Evolved: 0 to before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO
• Required configuration: protocols bgp group ... family inet/inet6 flow

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• For Junos OS 23.2, 23.4 and 24.2 and Junos OS Evolved 23.2-EVO, 23.4-EVO and 24.2-EVO, respins have been published. Earlier builds of these releases have been rebuilt.
• Unknown: fixed status of the 23.4X100 train (no fix listed in the sources).

Workaround

• No known workarounds.
• Disabling flow-spec (family inet/inet6 flow) on BGP groups removes the trigger path, if the feature is not needed. This is a general mitigation and not an official vendor workaround.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
• Not listed in the CISA KEV catalog (per third-party reporting, catalog version 2026.10.23).
• No public proof of concept known in the reports reviewed.

Our recommendation

• Check whether BGP with flow-spec (family inet/inet6 flow) is configured on your Junos or Junos OS Evolved devices.
• If you run BGP with flow-spec, plan the upgrade to a fixed release in the next maintenance window and verify versions against Juniper security bulletin JSA112187.
• Restrict configured BGP peers to trusted, filtered sessions (prefix filters, TTL security/GTSM).
• If you do not use BGP, the risk is low; keep devices on current releases.
• Monitor the bulletin for changes to exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Bulletin JSA112187 supportportal.juniper.net
• CCB Belgium advisory on Juniper Junos OS vulnerabilities ccb.belgium.be
• Offseq threat radar: CVE-2026-101990 radar.offseq.com
• Threatint CVE listing CVE-2026-101990 cve.threatint.com
• Strix CVE-2026-101990 www.strix.ai
• Positive Technologies PT-2026-113842 vulners.com
• SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:56.