IT SBIT Services
Schneeberger
DEEN
CVE tracker

Junos OS and Evolved: Denial of service in rpd via crafted BGP route update

CVE-2026-102025High 8.7

← All vulnerabilities

Summary

The routing protocol daemon (rpd) of Junos OS and Junos OS Evolved contains a memory management error (CWE-762) that can be triggered by a BGP route update. Successful exploitation causes a denial of service, typically an rpd crash and restart. The issue only occurs when extended next-hop tunneling and SRv6 service processing are used. The CNA description calls the attacker authenticated, while the CVSS 4.0 vector lists no privileges required, so the exact precondition must be verified in the Juniper advisory.

Affected

  • Junos OS: versions before 23.2R2-S7.7, 23.4 to before 23.4R2-S8.13, 24.2 to before 24.2R2-S5.5, 24.4 to before 24.4R2-S5, 25.2 to before 25.2R2-S2, 25.4 to before 25.4R1-S3, 26.2 to before 26.2R1-S2
  • Junos OS Evolved: versions before 23.2R2-S7.7-EVO, 23.4 to before 23.4R2-S8.11-EVO, 24.2 to before 24.2R2-S5.6-EVO, 24.4 to before 24.4R2-S5-EVO, 25.2 to before 25.2R2-S2-EVO, 25.4 to before 25.4R1-S3-EVO, 26.2 to before 26.2R1-S2-EVO, plus 23.4X100, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO (the 23.4X100 entry has no stated fix and needs verification)
  • Only with the configuration protocols bgp family inet unicast accept-srv6-service

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
  • Respins exist for 23.2, 23.4 and 24.2 (and the corresponding EVO releases); earlier builds of these releases were rebuilt, so check the advisory for the exact build per device model

Workaround

  • No known workarounds according to the CVE record.
  • Possible mitigation: if extended next-hop tunneling and SRv6 service processing are not needed, disable them.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • Not listed in CISA KEV; EPSS below 1 percent.
  • No public proof of concept found.

Our recommendation

  • Check whether any device in your environment runs Junos OS or Junos OS Evolved.
  • Check whether protocols bgp family inet unicast accept-srv6-service is configured; if not needed, disable it.
  • Restrict BGP peering to trusted, known neighbours.
  • Apply the fixed release for your device model from JSA112187, after confirming the exact build in the advisory.
  • Monitor for rpd restarts and crash files.
  • Also review the other October 2026 Junos bulletin items, especially J-Web (CVE-2026-101954, CVE-2026-101986): disable J-Web if not required and block access from untrusted networks.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:23.

Original description (NVD)

A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed