IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Infinite loop in rpd via EVPN multihoming DF election

CVE-2026-102185High 8.7

← All vulnerabilities

Summary

Juniper Junos OS and Junos OS Evolved are affected in the routing protocol daemon (rpd) when EVPN multihoming uses preference-based designated-forwarder (DF) election. A remote network attacker without authentication can trigger an infinite loop and cause a denial of service of the routing daemon, which can interrupt routing and the EVPN service on the device. The attack requires a device configured with EVPN multihoming and preference-based DF election. Juniper SIRT is not aware of malicious exploitation.

Affected

  • Junos OS: earlier than 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2 (default: unaffected)
  • Junos OS Evolved: earlier than 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, 23.4X100, 25.2X100 before 25.2X100-D35-EVO, 25.4X300 before 25.4X300-D40-EVO (default: unaffected)

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
  • Unknown: fixed build for Junos OS Evolved 23.4X100 is not listed in the mirrored data; check JSA112187.
  • Juniper states that previously published releases of 23.2, 23.4 and 24.2 (and their Evolved equivalents) were rebuilt as respins.

Workaround

Unknown. The CNA record states there are no known workarounds.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • Not listed in CISA KEV at the time of research.

Our recommendation

  • If you operate Junos OS or Junos OS Evolved in an EVPN fabric (for example in a data centre, hosting or managed-service setup), treat this as high priority and patch to a fixed release from JSA112187 in the next maintenance window.
  • Check the device configuration for EVPN multihoming with df-election-type preference. Changing this configuration has traffic impact and must be tested first.
  • Check JSA112187 for related CVE-2026-101943 (rpd, BGP EVPN update) and apply the same upgrade if it covers both.
  • If you have no EVPN deployment, the priority for your environment is low; confirm this through your device inventory.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:04.

Original description (NVD)

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed