Juniper Junos OS: Denial of service via BGP route updates in rpd

Summary

An integer overflow in the routing daemon (rpd) of Junos OS and Junos OS Evolved can be triggered by an authenticated BGP peer through crafted BGP route updates. The result is a denial of service, typically a crash of the routing daemon that disrupts routing. The issue only occurs when extended-nexthop-tunnel is configured for a BGP group, which is not the default; the impact is limited to availability.

Affected

• Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2
• Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; 23.4X100; 25.2X100 to < 25.2X100-D35-EVO; 25.4X300 to < 25.4X300-D40-EVO
• Only relevant if extended-nexthop-tunnel is configured (protocols bgp group <name> family inet unicast extended-nexthop-tunnel). Default configuration is unaffected.

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• For Junos OS 23.2, 23.4 and 24.2 and Junos OS Evolved 23.2-EVO, 23.4-EVO and 24.2-EVO, respins have been published; rebuilt versions of these releases resolve the issue.

Workaround

• Juniper documents no known workaround for this CVE.
• Interim step, inferred from the trigger condition and not a vendor-stated workaround: if extended-nexthop-tunnel is not needed, confirm it is not configured.
• Limit BGP peering to trusted, known peers.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• No public proof of concept or exploitation was found in the research; this is not a confirmed absence.

Our recommendation

• Check whether any Junos OS or Junos OS Evolved device runs BGP with extended-nexthop-tunnel configured.
• Schedule the Junos upgrade to the fixed releases as part of the full Juniper bulletin JSA112187, which also contains more severe issues.
• Until patched, restrict BGP peering to trusted peers and monitor rpd for crashes and unexpected session resets.
• Networks without BGP peering or without this configuration can deprioritise this CVE.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• VulnRichment CVE-2026-102024 vulners.com
• OpenCVE CVE-2026-102024 app.opencve.io
• ThreatInt CVE-2026-102024 cve.threatint.com
• SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:22.