IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Stack-based buffer overflow in rpd causes denial of service

CVE-2026-102180High 8.7

← All vulnerabilities

Summary

A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved can be triggered by a crafted BGP route attribute. An attacker with access to a configured BGP peering session can crash rpd and cause a denial of service. The crash only occurs while a BGP RIB streaming telemetry subscription is active. The CVSS v4.0 base score is 8.7 (High), driven by high availability impact.

Affected

  • Junos OS: releases from 22.1R1 up to but excluding 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2 (per CVE record; verify against advisory)
  • Junos OS Evolved: releases from 22.1R1-EVO up to but excluding 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, plus 23.4X100, 25.2X100 and 25.4X300 trains as listed in the record
  • Unknown whether cRPD is affected

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
  • Previously published 23.2, 23.4 and 24.2 builds were rebuilt (respins); check whether your build is a rebuilt image
  • Unknown: no fixed version identified for the 23.4X100-EVO train

Workaround

  • Official CVE record: no known workarounds.
  • Unverified: disabling BGP RIB streaming telemetry subscriptions may remove the trigger. Sources conflict; confirm in the Juniper advisory before relying on it.

Exploitation

  • Juniper SIRT is not aware of malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • Not listed in CISA KEV.
  • No public proof of concept found in research; this does not prove none exists.
  • Discovered internally by Juniper.

Our recommendation

  • Identify all Junos OS and Junos OS Evolved devices running BGP with RIB streaming telemetry enabled.
  • Upgrade to a fixed release listed in JSA112187; confirm whether your build is a rebuilt image.
  • If you cannot patch soon, disable BGP RIB streaming telemetry subscriptions after confirming this in the advisory.
  • Restrict BGP peering to known neighbours and filter BGP sessions where possible.
  • Monitor rpd crashes and unexpected routing process restarts.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:06.

Original description (NVD)

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed