Junos OS Evolved: Stack-based buffer overflow causes kernel panic
Summary
A stack-based buffer overflow in the kernel of Junos OS Evolved allows an unauthenticated remote attacker to crash the device with a crafted TCP packet. The flaw only applies when key-chain authentication is used for BGP or LDP. The CVSS 4.0 vector shows impact on availability only, so a crash and routing outage is the expected result, not code execution.
Affected
- Junos OS Evolved 0 to before 23.2R2-S7.7-EVO
- 23.4 to before 23.4R2-S8.11-EVO
- 24.2 to before 24.2R2-S5.6-EVO
- 24.4 to before 24.4R2-S5-EVO
- 25.2 to before 25.2R2-S2-EVO
- 25.4 to before 25.4R1-S3-EVO
- 26.2 to before 26.2R1-S2-EVO
- 23.4X100
- 25.2X100 to before 25.2X100-D35-EVO
- 25.4X300 to before 25.4X300-D40-EVO
(Per the CNA record; not yet verified against vendor advisory JSA112250.)
Fixed in
- 23.2R2-S7.7-EVO
- 23.4R2-S8.11-EVO
- 24.2R2-S5.6-EVO
- 24.4R2-S5-EVO
- 25.2R2-S2-EVO
- 25.2X100-D35-EVO
- 25.4R1-S3-EVO
- 25.4R2-EVO
- 25.4X300-D40-EVO
- 26.2R1-S2-EVO
- 26.2R2-EVO
- 26.4R1-EVO
- All subsequent releases
For 23.2-EVO, 23.4-EVO and 24.2-EVO, respins have been published; previously published versions were rebuilt.
Workaround
- Replace key-chain authentication with a single authentication-key (no chain), or use TCP-AO or MD5 for BGP and LDP sessions.
- Restrict which hosts can reach TCP 179 (BGP) and TCP 646 (LDP) on the device.
- Confirm the workaround in JSA112250 before applying it, as it weakens session authentication.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found in our research.
- EPSS score 0.00739.
Our recommendation
- Identify any Junos OS Evolved devices in your environment.
- Check whether key-chain authentication is configured for BGP or LDP.
- Upgrade to a fixed release listed in JSA112250, or apply a workaround if upgrading is not possible.
- Limit BGP and LDP peering to known peers and restrict these ports to trusted networks.
- Monitor the device for unexpected restarts or kernel panics.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112250 supportportal.juniper.net
- OpenCVE: CVE-2026-102068 app.opencve.io
- CISA-ADP/Vulnrichment via Vulners vulners.com
- VulDB entry vuldb.com
- Juniper routing protocol authentication documentation www.juniper.net
- Strix CVE-2026-102068 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:27.
Original description (NVD)
A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.