Juniper Junos OS: Numeric truncation in rpd allows denial of service

Summary

A numeric truncation error (CWE-197) in the rpd routing daemon of Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to crash rpd and cause a denial of service. The attack uses a BGP Prefix-SID route advertisement that is subsequently re-advertised. All iBGP sessions are affected; eBGP sessions are only affected if accept-prefix-sid is enabled. Juniper SIRT is not aware of any malicious exploitation.

Affected

• Junos OS: releases from 20.4R1 up to the fixed releases listed below (CVE record ranges include 23.2 before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2)
• Junos OS Evolved: releases from 20.4R1-EVO up to the fixed releases listed below (CVE record ranges include 23.4X100, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO)
• Earlier releases (before 20.4R1 and 20.4R1-EVO) are not affected.

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Verify the exact versions for your platform and train in advisory JSA112187.

Workaround

There are no known workarounds for this issue according to the CVE record. Unknown whether the vendor advisory adds mitigations.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof-of-concept found in the sources reviewed.

Our recommendation

• Check whether BGP runs on your Junos OS and Junos OS Evolved devices, especially with Prefix-SID or accept-prefix-sid enabled.
• Plan the upgrade to a fixed release in the next maintenance window and include other rpd fixes from the same release.
• Until patched, keep accept-prefix-sid disabled on eBGP groups where it is not required (not vendor-stated; confirm in JSA112187).
• Monitor for rpd crashes and unexpected BGP session resets as a detection signal.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• CVE record (CVE List V5 JSON) raw.githubusercontent.com
• Strix CVE-2026-33795 www.strix.ai
• VulDB 420149 vuldb.com
• Positive Technologies PT-2026-114196 vulners.com
• OpenCVE CVE-2026-33795 app.opencve.io
• Stack.watch Juniper Junos OS stack.watch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:58.