Juniper Junos OS: Denial of service in rpd via BGP labeled-unicast UPDATEs
Summary
Junos OS and Junos OS Evolved are affected in the routing protocol daemon (rpd), caused by an incorrect calculation of buffer size (CWE-131). A configured eBGP neighbor can send crafted BGP labeled-unicast UPDATE messages that crash rpd, interrupting routing. The attack only works when the affected multipath features are enabled, and the CNA lists only availability impact (CVSS 4.0: 8.7).
Affected
- Junos OS: 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
- Junos OS Evolved: 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO
- Required configuration: protocols bgp multipath list-nexthop; routing-options forwarding-table chained-composite-next-hop ingress labeled-bgp inet
Fixed in
- Junos OS: 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases
- Junos OS Evolved: 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases
Workaround
No known workarounds for this issue (according to the CVE record). Reduce exposure by restricting eBGP peering to known neighbors and by disabling the affected multipath features if they are not needed.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Check whether any Junos or Junos Evolved device runs BGP labeled-unicast with multipath.
- If so, compare the running version with the Juniper advisory JSA112187 and schedule the fixed release. One upgrade covers the sibling CVEs in the same advisory.
- Review the eBGP peer list and filters, and alert on unexpected rpd restarts.
- Verify all version details in the Juniper advisory before acting, as secondary sources were not confirmed against it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112187 supportportal.juniper.net
- OpenCVE record CVE-2026-102027 app.opencve.io
- Threatint CVE record CVE-2026-102027 (CVSS 3.1 score) cve.threatint.com
- Strix CVE record CVE-2026-102027 (secondary, unverified versions) www.strix.ai
- PT-2026-113868 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:24.
Original description (NVD)
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.