IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: NULL pointer dereference in rpd enables remote DoS via BGP

CVE-2026-102028High 8.7

← All vulnerabilities

Summary

A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved affects devices with 'bgp family l2vpn auto-discovery-only' configured. A remote BGP peer that sends multiple UPDATE messages over a single TCP session can crash rpd, causing a denial of service and routing disruption. Exploitation requires a BGP session with the peer, and the CVSS vector shows no confidentiality or integrity impact.

Affected

  • Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
  • Junos OS Evolved: 0 to before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO
  • Only configurations with 'protocols bgp family l2vpn auto-discovery-only' are affected (default: unaffected)

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
  • Respins exist for Junos OS 23.2, 23.4 and 24.2 and the corresponding Evolved releases; earlier versions of these were rebuilt

Workaround

  • No known workarounds from the vendor.
  • Unverified: removing 'auto-discovery-only' from the L2VPN BGP family would likely avoid the trigger, but no source confirms this. Verify with Juniper first.

Exploitation

  • Juniper SIRT is not aware of malicious exploitation.
  • Not listed in CISA KEV. CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof-of-concept known.

Our recommendation

  • Check whether Junos or Junos Evolved devices run BGP with 'family l2vpn auto-discovery-only'.
  • Read Juniper advisory JSA112187 for the exact per-release table and apply the fixed releases.
  • Restrict BGP sessions to known peers and use session authentication.
  • Review the full bulletin JSA112187, which contains other critical issues.
  • Monitor the device for rpd crashes and watch for the NVD analysis.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:17.

Original description (NVD)

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed