Junos OS: Denial of Service in rpd via BGP-LS routing updates
Summary
A reachable assertion in the rpd routing process of Junos OS and Junos OS Evolved lets a network-based attacker crash rpd with crafted BGP-LS routing updates, causing a denial of service and a routing outage on the device. The vendor record says the attacker must be authenticated, but the CVSS 4.0 vector shows no privileges required, so the conditions are not clear. The issue applies only when BGP-LS traffic engineering database export is enabled.
Affected
- Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2
- Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; 23.4X100; 25.2X100 to < 25.2X100-D35-EVO; 25.4X300 to < 25.4X300-D40-EVO
- Required configuration: BGP-LS traffic engineering (family traffic-engineering unicast) and TED export (mpls traffic-engineering database export policy)
Fixed in
- Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
- Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
- Unknown for Junos OS 23.4X100, as no fixed release is listed.
Workaround
Unknown.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof of concept was found for this CVE.
Our recommendation
- Check whether BGP-LS traffic engineering or TED export is enabled on your Junos OS or Junos OS Evolved devices.
- If it is enabled, update to a fixed release listed above, or confirm the fix status for your release in JSA112187.
- If the functionality is not required, disable it, after checking the advisory.
- Limit BGP sessions to known peers and monitor rpd crashes and routing instability.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Bulletin JSA112187 supportportal.juniper.net
- OpenCVE: CVE-2026-102020 app.opencve.io
- CVE Threat Intelligence: CVE-2026-102020 cve.threatint.com
- Vulners VulnRichment: CVE-2026-102020 vulners.com
- Strix.ai: CVE-2026-102020 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:26.
Original description (NVD)
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.