IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Denial of service in routing daemon via BGP EVPN

CVE-2026-102179High 8.7

← All vulnerabilities

Summary

Junos OS and Junos OS Evolved are affected by an out-of-bounds write in the routing protocol daemon (rpd). An attacker with access to a configured BGP EVPN peer can crash rpd by sending crafted EVPN routes, but only when the l2vpn-evpn RIB telemetry sensor is subscribed. The crash interrupts routing protocols until rpd restarts and routes reconverge.

Affected

  • Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2
  • Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; 23.4X100; 25.2X100 to < 25.2X100-D35-EVO; 25.4X300 to < 25.4X300-D40-EVO
  • Source: CNA record. The vendor advisory JSA112187 could not be retrieved and must be checked.

Fixed in

Per CNA record, verify in JSA112187:

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all later releases
  • Some 23.2, 23.4 and 24.2 releases have been respun and rebuilt.

Workaround

  • The CNA record states that there are no known workarounds.
  • A secondary source suggests disabling l2vpn-evpn RIB telemetry subscriptions. This is unconfirmed and conflicts with the CNA record, so verify it in JSA112187 before relying on it.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • SSVC in the CNA record: exploitation none, automatable yes, technical impact partial.
  • Not listed in CISA KEV. No public proof of concept was found as of 1 November 2026.

Our recommendation

  • Check whether Junos OS or Junos OS Evolved with BGP EVPN is in use, and whether l2vpn-evpn RIB telemetry is subscribed.
  • Retrieve JSA112187 and confirm the fixed release for each platform and release train.
  • Plan the upgrade to a fixed release, or disable the telemetry subscription if it is not needed and the advisory confirms this as a mitigation.
  • Limit BGP EVPN peering to trusted, known peers.
  • Priority: moderate where EVPN and streaming telemetry are used, low otherwise.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:05.

Original description (NVD)

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed