Juniper Junos OS: Denial of service via malformed SRv6 service route
Summary
Junos OS and Junos OS Evolved are affected by a flaw in the routing protocol daemon (rpd) that handles BGP-signaled SRv6 service routes. A remote, unauthenticated BGP peer can send a malformed route and crash rpd, which interrupts routing on the device. The attack requires that SRv6 dynamic tunnels are enabled together with BGP EVPN SRv6 service signaling. The vendor's CVSS v4.0 score reflects availability impact only.
Affected
- Junos OS: 23.4; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2.
- Junos OS Evolved: 23.4; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO.
- Only with the required configuration: protocols bgp family evpn signaling accept-srv6-service and routing-options dynamic-tunnels srv6.
Fixed in
- Junos OS: 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and later.
- Junos OS Evolved: 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later.
- Junos OS 23.4: Unknown.
- Previously published 24.2 and 24.2-EVO builds were rebuilt; check the advisory for the exact release.
Workaround
- No known workarounds according to the vendor record.
- Unverified measure: if SRv6 dynamic tunnels are not used, disabling them may remove the exposure. Confirm with Juniper before relying on this.
- Limit which BGP peers can establish sessions.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC rates exploitation as none; automatable: yes.
- No public proof of concept known.
Our recommendation
- Check whether Junos or Junos OS Evolved devices use BGP EVPN SRv6 service signaling and SRv6 dynamic tunnels.
- Restrict BGP sessions to trusted peers.
- Plan the upgrade to a fixed release listed in JSA112187 and confirm the Junos 23.4 fix with Juniper.
- Monitor rpd crashes and BGP session resets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112187 supportportal.juniper.net
- CVE record (CVE List V5, raw JSON) raw.githubusercontent.com
- OpenCVE entry CVE-2026-102065 app.opencve.io
- Vulnrichment CVE-2026-102065 vulners.com
- Junos dynamic-tunnels statement reference www.juniper.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:08.
Original description (NVD)
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.