Denial of service affecting the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is triggered when crafted or malformed BGP-LS (BGP Link-State) routing updates hit a reachable assertion in the daemon, causing it to terminate. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the attacker must hold a valid, authenticated BGP peering session with the target and the device must be configured for BGP-LS; devices that do not run BGP-LS, or that peer only with trusted and uncompromised neighbors, are not realistically exposed. Impact is confined to availability of the rpd process with automatic recovery, no confidentiality or integrity impact applies, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered when the routing protocol daemon (rpd) fails to properly validate a quantity field carried in a BGP MVPN (Multicast VPN) signaling update, allowing the crafted message to disrupt rpd and impair routing on the affected device. Exploitation is constrained by a strong precondition: the target must be configured for BGP MVPN signaling, and the sender must be - or must impersonate - an already configured, established BGP MVPN peer, so exposure is limited to the BGP MVPN peering trust boundary rather than arbitrary internet hosts. Impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 score 8.7), with supplemental metrics indicating automatic recovery; no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-positioned attacker to disrupt the routing protocol daemon (rpd) by delivering a crafted BGP EVPN update message. Affected releases include multiple Junos OS and Junos OS Evolved versions, but exposure requires that BGP with the EVPN address family be configured - a non-default setting typical of EVPN-VXLAN data center fabrics - and the attacker must be able to reach rpd over an established BGP EVPN session (a configured peer or an on-path attacker on the peering path). Impact is availability-only (control-plane DoS) with no confidentiality or integrity exposure; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote attackers can bypass access controls in the TSplus Remote Access web server via manipulated paths on the /socket.io/JWN/ endpoint, leading to disclosure of protected internal resources. This high-severity vulnerability (CVSS 4.0 base 8.7) affects internet-exposed portals with no authentication or user interaction required. No public exploit identified at time of analysis, but the flaw is trivially exploitable given network reachability.
A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.
A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.
Denial of service in Juniper Junos OS and Junos OS Evolved can be triggered by a remote BGP EVPN neighbor when SRv6 EVPN multihoming is configured, causing the routing protocol daemon (rpd) to crash. The issue affects specific Junos OS trains (25.2, 25.4, 26.2) and Junos OS Evolved trains (23.4X100, 25.2, 25.2X100, 25.4, 25.4X300, 26.2) below their fixed service releases. No public exploit identified at time of analysis, and exploitation is gated by the non-default SRv6 EVPN multihoming configuration plus an established BGP EVPN peering relationship.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in Gitingest 0.3.1 and earlier allows remote attackers to retrieve any file readable by the service account, in chunks capped at 10 MB per request, by committing a symbolic link into a public repository and submitting that symlink's blob URL to the single-file ingestion path in ingest_query. The server resolves the link and returns the target file's contents instead of confining reads to in-repo content, so a network-reachable instance that accepts untrusted repository or blob URLs - the default mode for both the hosted service and self-hosted deployments - is directly exposed with no credentials or user interaction required. There is no CISA KEV listing and no public exploit identified at time of analysis, though a public technical writeup describing the symlink technique accompanies the VulnCheck advisory; impact is bounded by the service account's file permissions and the 10 MB per-request cap.
Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.
Denial of service affecting Juniper Networks Junos OS and Junos OS Evolved: an unauthenticated remote attacker who can deliver a specifically malformed BGP EVPN multicast update to a device configured for EVPN multicast can crash the routing protocol daemon (rpd) when that update is processed for readvertisement, taking down routing on the affected box. Per the vendor's CVSS 4.0 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), the impact is availability-only, but exposure is bounded by a real prerequisite: the target must run EVPN multicast (e.g. EVPN handling of IGMP/MLD / SMET multicast routes) with a live BGP session, and the attacker needs a peering relationship or on-path injection capability for the update to arrive and be readvertised. Vendor-released patches are available and no public exploit code has been identified at time of analysis, so this is a genuine but bounded operational risk.
Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved: a malformed BGP ISO-VPN (CLNS/IS-IS L3VPN) update from an accepted ISO-VPN peer crashes the routing protocol daemon (rpd) when that update is subsequently handled by BMP route monitoring or by NSR replication, taking down routing on the affected device (CVSS 4.0 base 8.7; AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L). Exploitation requires no credentials on the wire, but it is gated by a pre-established BGP ISO-VPN peering relationship, so realistic exposure is limited to compromised or malicious peers rather than arbitrary internet hosts, and the device must additionally have BMP route monitoring or NSR enabled. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; exploitation yields only availability impact, with no confidentiality or integrity loss on the router itself.
A specific BGP packet sent by an existing eBGP peer can trigger a NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Junos OS and Junos OS Evolved, killing the routing daemon and causing a denial of service (CVSS 4.0 base 8.7; independent assessment scores it AV:N/AC:H/PR:N/UI:N/A:H with no confidentiality or integrity impact). Exploitation is gated by two preconditions: the device must have a nexthop-ecmp qualifier attached to a BGP import policy - an explicitly deployed, non-default routing-policy configuration - and the sender must already be a configured eBGP peer, so an arbitrary unauthenticated Internet host cannot reach the flaw; the CVSS vectors carry PR:N, but reachability still requires an established BGP peering session. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available per Juniper advisory JSA112187.
A crafted BGP Prefix-SID (Segment Routing) route that is received and then re-advertised by the rpd routing daemon triggers a numeric truncation error in Juniper Junos OS and Junos OS Evolved 20.4R1 / 20.4R1-EVO and later, letting an unauthenticated network-based attacker cause a denial of service against the affected device. Exposure is limited to devices that actually run BGP with Prefix-SID in use, and the malformed route must be accepted into the BGP control plane and re-advertised, which in realistic deployments implies a BGP adjacency or an upstream/route-injection position rather than arbitrary off-path Internet access. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published fixed maintenance releases covered by advisory JSA112187, so exposure is a patch-management problem rather than an active campaign.
A remote, unauthenticated attacker can cause a denial of service in the routing protocol daemon (rpd) of Juniper Junos OS and Junos OS Evolved by sending crafted EVPN multihoming traffic when the device is configured with preference-based designated-forwarder election. The flaw, an infinite loop (CWE-835), halts the routing daemon and affects only availability, with no confidentiality or integrity impact. Exploitation requires the non-default EVPN multihoming feature to be enabled; a vendor patch (JSA112187) is available, and no public exploit has been identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.
Stack-based buffer overflow in Juniper Networks Junos OS jdhcpd lets an unauthenticated adjacent attacker crash the DHCP client process with a crafted DHCP response, causing denial of service for DHCP, relay, and zero-touch-provisioning services on devices configured as DHCP clients. Exploitation requires L2 adjacency to the victim and no authentication or user interaction; devices not operating as DHCP clients are not exposed, and service recovers once malicious traffic stops. Vendor patches are available per Juniper advisory JSA112188, and no public exploit code has been identified at time of analysis.
Authentication bypass in F5 NGINX Ingress Controller allows unauthenticated remote attackers to access protected paths when an externalAuth policy delegating to an OAuth identity provider is configured. The flaw is due to incorrect handling of the IdP's HTTP response (CWE-303), enabling access before proper authentication completes. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it requires no privileges or user interaction, impacts confidentiality only, and is strictly a data plane issue with no control plane exposure. No public exploit has been identified at time of analysis; only deployments using externalAuth with OAuth are affected.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.
Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.
Stack-based buffer overflow in the authd process of Juniper Networks Junos OS allows an attacker who can influence a configured RADIUS server to crash the device or execute arbitrary code with root privileges. This unauthenticated, adjacent-network attack (CVSS 8.7) is limited to devices that have RADIUS authentication enabled and where the attacker either controls the RADIUS server or can inject or modify RADIUS responses on the adjacent network. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed (not in CISA KEV).
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Adjacent, unauthenticated code execution as root affects Juniper Junos OS and Junos OS Evolved devices that support Secure-ZTP when their phone-home daemon (phcd) processes a crafted DHCP SZTP bootstrap message. The flaw is a stack-based buffer overflow (CWE-121) that can be triggered by a network-adjacent attacker (CVSS 4.0 AV:A/AC:L/PR:N/UI:N, vendor score 8.7 High); no credentials or user interaction are required, but the target must be a Secure-ZTP-capable platform actively in the DHCP SZTP bootstrap/provisioning state and the attacker must be on the same Layer-2/logical segment. Vendor patches are available; no public exploit code or KEV-listed active exploitation was identified in the provided data.
A stack-based buffer overflow in Juniper's jdhcpd process lets an adjacent, unauthenticated attacker crash or potentially achieve root-level code execution on Junos OS and Junos OS Evolved devices that are configured to use the DHCPv4 local-client feature. Exploitation requires the device to act as a DHCPv4 client and an attacker to sit on the same Layer 2 segment able to deliver a malformed DHCPv4 server response (for example via a rogue or spoofed DHCP server); there is no public exploit identified at time of analysis, but a vendor patch is available. Because jdhcpd runs with root privileges, a successful overflow could yield high confidentiality, integrity and availability impact, making this a mid-to-high priority issue for exposed deployments rather than a universal emergency.
Adjacent unauthenticated attackers can trigger a stack-based buffer overflow in the l2cpd process on Juniper Junos OS and Junos OS Evolved by sending crafted LLDP traffic to an interface configured with Unified Access Policy, potentially causing a denial of service or root-level code execution. Exploitation requires Layer-2 adjacency and the non-default UAP configuration, so this is a high-priority networking vulnerability rather than a universal emergency. No public exploit identified at time of analysis, and a vendor patch is available.
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a crafted primary zone file to perform out-of-bounds stack writes, including overwriting a callback function pointer that is invoked immediately after parsing, which can lead to arbitrary code execution. The vulnerable path requires direct ingestion of a specially formatted zone file; NSD-generated zone files, including those for secondary zones received by transfer, are not formatted in the triggering way and will not exploit the flaw. No public exploit code or confirmed active exploitation is identified in the available intelligence, and the assessed vector requires low privileges (PR:L) through local or zone-supply access rather than ordinary remote DNS queries.
Stack-based buffer overflow in the cfmd process of Juniper Junos OS and Junos OS Evolved on MX Series and PTX Series platforms enables unauthenticated adjacent-network attackers to execute arbitrary code as root or cause denial of service when enhanced CFM mode and a configured down-MEP are present. The CVSS 8.7 score reflects high confidentiality, integrity, and availability impact, but real-world exposure is constrained by the non-default CFM/802.1ag configuration and the need for Layer 2 adjacency; no public exploit identified at time of analysis.
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supply a crafted zone file to corrupt memory and potentially achieve arbitrary code execution. The flaw is triggered when the RDATA is filled to the wire-format limit and an ECH parameter overflows the stack, after which the base64 decoder can write attacker-controlled data of unlimited size. Exploitation requires that the crafted zone file be fed directly to NSD; zone files written by NSD itself (e.g., secondary zones) are not affected. The attacker must control or inject into the zone-provisioning path, such as a multi-tenant zone-submission pipeline, and authentication requirements are low-privileged per the CVSS vector (PR:L). No public exploit or in-the-wild exploitation has been identified at time of analysis.
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data split into chunks of three characters or fewer, causing the token length calculation to yield zero bytes and letting an attacker overwrite up to 64K of stack memory with attacker-controlled data, with likely code-execution impact. Our independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact, reflecting that the attacker must control zone-file content fed directly to NSD (PR:L, i.e., write/submit access to the zone input path) - it is not reachable through normal DNS queries and does not affect zone files NSD generates itself, such as zones for which the instance is secondary. The vendor rates it CVSS 4.0 8.7 (High) with AV:N/PR:L; patch availability is not confirmed in the provided data, and no public exploit code or CISA KEV activity was identified at time of analysis.
Eclipse NetX Duo's NetX Secure DTLS server can be driven into completing handshakes with forged source addresses because the cookie it issues in a HelloVerifyRequest is never actually validated: the ClientHello parser copies the client-supplied cookie bytes over the value the server generated, and the server then treats the peer as verified based on the cookie's length alone, so a single arbitrary cookie byte in the first ClientHello skips the return-routability exchange entirely. The defect is remotely reachable with no authentication and no user interaction (CVSS 4.0 base 8.7, High; the independent assessment confirms AV:N/AC:L/PR:N/UI:N with an availability-only impact), and the practical harm is anti-spoofing and availability abuse - spoofed-source handshakes, amplification potential, and handshake state/resource exhaustion - not data compromise or code execution. No public exploit code has been identified at time of analysis, and CVE-2026-106465 is not listed in CISA KEV.
Arbitrary file read in GitPython before 3.2.0 occurs when a vulnerable application clones an attacker-controlled repository and then calls Head.checkout() on the repository's default branch; a branch named like --pathspec-from-file=<path> is parsed by Git as an option rather than a branch, causing readable file contents to be leaked through GitCommandError messages. This is a credible but conditional information-disclosure flaw, not a drop-everything emergency: only confidentiality is affected, exploitation requires the target to process untrusted repositories and surface error output, and no public exploit identified at time of analysis. Unauthenticated network exploitation is possible per the PR:N vector, and the vendor patch is GitPython 3.2.0.
Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
A stack-based buffer overflow in the l2cpd (Layer 2 Control Protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker who is Layer 2 adjacent - on the same broadcast domain or directly cabled to the target interface - crash Layer 2 control-plane processing by sending crafted LLDP packets to an interface with LLDP enabled. The primary outcome is denial of service: repeated triggering can destabilize LLDP and other Layer 2 control protocols on the device, though the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, ~6.5) rates this as availability-only impact with no confidentiality or integrity loss. Exploitation is gated by two prerequisites - the attacker must already have local Layer 2 presence and the targeted interface must explicitly have LLDP configured - so remote Internet-based attacks are not possible; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and vendor patches are available.