Junos OS: Denial of service in rpd via malformed BGP MCAST-VPN updates
Summary
A reachable assertion in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved allows a denial of service. A configured eBGP peer that sends malformed BGP MCAST-VPN updates can crash rpd, which interrupts routing on the device. The issue only applies when the MCAST-VPN address family or inter-AS MVPN ingress replication is configured.
Affected
- Junos OS: versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2 (per CVE record; Juniper advisory to be verified)
- Junos OS Evolved: versions before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO and 26.2R1-S2-EVO (per CVE record; Juniper advisory to be verified)
- Configuration required: family inet-mvpn signaling in BGP or inter-AS MVPN ingress replication
Fixed in
- Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later
- Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later
Workaround
Unknown. Juniper SIRT states there are no known workarounds.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability. CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Check whether BGP with family inet-mvpn signaling or inter-AS MVPN ingress replication is configured
- Read Juniper advisory JSA112187 and verify the fixed versions before patching
- Plan one maintenance window to upgrade to a fixed release, as the same bulletin covers several CVEs
- Check which images you download, as some releases were respun
- Restrict eBGP sessions to known peers and disable MCAST-VPN where it is not needed
- Monitor for rpd crashes and unexpected routing restarts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112187 supportportal.juniper.net
- CVE record mirror (OpenCVE) app.opencve.io
- Third-party listing with version data (OffSeq Radar) radar.offseq.com
- Strix AI CVE entry www.strix.ai
- Sibling CVE-2026-101943 analysis (bulletin context) safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:07.
Original description (NVD)
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.