Junos OS: Stack-based buffer overflow in jdhcpd allows denial of service

Summary

A stack-based buffer overflow in the jdhcpd DHCP process of Junos OS allows an unauthenticated attacker on an adjacent network to cause a denial of service through a crafted DHCP client response. The attack can interrupt DHCP client operation and related DHCP, relay and zero-touch-provisioning services. The issue only applies where the affected DHCP client configuration is in use, and no code execution has been reported. The CVSS 4.0 score is 8.7, while the CVSS 3.1 score is 7.5, and the CNA describes the attacker as adjacent while the vector shows network access.

Affected

• Junos OS before 23.2R2-S7.7
• Junos OS 23.4 before 23.4R2-S8.13
• Junos OS 24.2 before 24.2R2-S5.5
• Junos OS 24.4 before 24.4R2-S5
• Junos OS 25.2 before 25.2R2-S2
• Junos OS 25.4 before 25.4R1-S3
• Junos OS 26.2 before 26.2R1-S2
• Only if interfaces are configured with family inet/inet6 dhcp
• Junos OS Evolved: Unknown.
• Verify the versions against the vendor advisory JSA112188.

Fixed in

• Junos OS 23.2R2-S7.7
• Junos OS 23.4R2-S8.13
• Junos OS 24.2R2-S5.5
• Junos OS 24.4R2-S5
• Junos OS 25.2R2-S2
• Junos OS 25.4R1-S3 or 25.4R2
• Junos OS 26.2R1-S2 or 26.2R2
• Junos OS 26.4R1 and all later releases
• Note: For 23.2, 23.4 and 24.2, respins have been released. Previously published builds of these releases have been rebuilt.

Workaround

• No known workarounds according to the CNA record.
• Own analysis, not from a source: limit DHCP client exposure to trusted Layer 2 segments and restrict which devices can reach these systems on adjacent networks.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC lists exploitation as none and automatable as yes.
• No public proof of concept found. VulDB states that the technical details are unknown.

Our recommendation

• Check whether Juniper Junos OS devices are in use. If not, no action is needed.
• Patch affected devices to the fixed release for your Junos train during the next maintenance window.
• Review the DHCP client configuration and restrict adjacent-network access to the affected devices.
• Monitor for DHCP service interruptions and check the Evolved advisory if you run Evolved platforms.
• Check the related CVE-2026-102052 (JSA112187), which is rated higher and concerns the DHCPv4 local-client feature.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112188 supportportal.juniper.net
• VulDB entry 420163 vuldb.com
• OpenCVE CVE-2026-102057 app.opencve.io
• threatint CVE-2026-102057 cve.threatint.com
• Positive Technologies PT-2026-113897 vulners.com
• OpenCVE CVE-2026-102052 (related) app.opencve.io
• SecurityOnline: Juniper patches Junos OS vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:14.