EUVD-2026-101485
GHSA-gr8p-6626-rr6j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish or compromise adjacent BGP peering
-
ExploitSend crafted labeled-unicast BGP update
-
ExecutionTrigger reachable assertion in rpd
-
ImpactCrash routing daemon causing DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires the target Junos OS or Junos OS Evolved device to be configured with labeled-unicast aggregate-label (a non-default BGP labeled-unicast setting) and requires the attacker to be a network-adjacent, already-established BGP peer of that device (AV:A). Limiting factors: devices without the aggregate-label configuration are not affected, and the attacker must occupy a configured BGP peering relationship rather than being an arbitrary remote host, which substantially narrows the exploitable attack surface despite the CVSS PR:N marking. Impact is limited to denial of service (rpd crash); no confidentiality or integrity compromise occurs. |
| Impact | This is a genuine but conditional priority, not an inflated high-CVSS issue. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) rates it 7.1 with impact confined to availability (VA:H, SA:L) and no confidentiality or integrity effect - consistent with a CWE-617 reachable assertion that crashes rpd rather than enabling code execution. The AV:A (adjacent) vector and the requirement to be an established BGP peer materially constrain the attacker population to already-peered neighbors, so this is closer to a trusted-adjacency denial-of-service than an internet-wide threat. No EPSS score, CISA KEV entry, or public PoC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is latent rather than demonstrated. Note a signal nuance: CVSS marks PR:N (no privileges), yet exploitation requires the attacker to be a configured BGP peer and the target to have the non-default labeled-unicast aggregate-label feature enabled, so the real-world precondition set is narrower than PR:N alone implies - verify neighbor trust posture when prioritizing. |
| Exploit ScenarioDerived | An attacker controlling (or who has compromised) a device that is an established BGP peer of a vulnerable Junos OS / Junos OS Evolved router sends crafted labeled-unicast BGP messages. On a router configured with labeled-unicast aggregate-label, processing these triggers a reachable assertion in the routing protocol daemon (rpd), crashing it and disrupting routing (denial of service). No public PoC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Earlier versions of this analysis (1)
A reachable assertion in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved can crash the daemon when a network-adjacent BGP peer sends traffic against a device configured for BGP labeled-unicast aggregate-label, causing a denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is unauthenticated in the CVSS sense (PR:N) and needs no user interaction, but it is strictly gated: the attacker must already hold an established BGP peering/adjacency with the target and the device must explicitly have the non-default aggregate-label feature enabled, so default or unconfigured deployments are not exposed. No public exploit or proof-of-concept code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical risk is limited to the narrow population of BGP-LU deployments that have this specialized configuration active.
RemediationAI
The primary fix is to upgrade to a Juniper-patched Junos OS or Junos OS Evolved release; the exact fixed versions for each platform and release train are published in Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187), and no exact fixed version number is stated in the data provided here, so the advisory must be consulted rather than assuming a version. If an immediate upgrade is not feasible, the most effective compensating control is to remove the aggregate-label setting from the labeled-unicast configuration (or disable labeled-unicast aggregate-label entirely) - this removes the vulnerable code path and eliminates exposure, at the cost of losing the aggregate-label operational behavior that may be relied on for MPLS label aggregation; this should be treated as a temporary mitigation only. Additional hardening reduces the population of peers that can reach the assertion: restrict BGP sessions to explicitly trusted neighbor addresses, filter inbound labeled-unicast NLRIs (prefix/label filters) to reject unexpected aggregate-label routes, and enable BGP session protections such as TCP MD5/TCP-AO and TTL security (GTSM) so that only directly connected, legitimately configured peers can form a session - these steps do not fix the underlying assertion but they limit who can trigger it and carry the usual trade-offs of added session-management overhead and the risk of breaking legitimate peerings if filters are too strict. No public exploit code has been identified at time of analysis, so remediation can be scheduled with the understanding that the risk is conditional on configuration and existing peering relationships.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
At the root of this issue is CWE-617, Reachable Assertion: an internal consistency check (assert) inside Juniper's routing protocol daemon (rpd) can be reached with data supplied by a BGP peer, and when it fails the daemon aborts instead of handling the condition gracefully. The affected subsystem is BGP labeled-unicast (BGP-LU), which carries MPLS labels in BGP updates for inter-AS and seamless MPLS designs, combined with Juniper's aggregate-label option that allows labeled-unicast routes to be advertised with a label allocated from an aggregate range rather than a per-route label. When an established labeled-unicast peer sends updates that exercise that aggregate-label path in an unexpected way, rpd hits the assertion and restarts. Both code bases listed in the CPE data are affected - cpe:2.3:a:juniper_networks:junos_os (FreeBSD-based Junos OS) and cpe:2.3:a:juniper_networks:junos_os_evolved (the Linux-based, modular Junos OS Evolved, where rpd runs in its own isolated process) - because they share the rpd BGP labeled-unicast implementation. The attack vector is network-adjacent (AV:A) and the CVSS vector marks PR:N, but in practice the attacker must already hold a configured, established BGP peering session with the target; devices that do not enable labeled-unicast aggregate-label never reach the vulnerable code path.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Adjacent BGP peer (AV:A), low complexity, no CVSS-rated privileges (PR:N); rpd crash disrupts routing beyond the daemon so S:C with availability-only impact (A:H).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved contain a denial-of-service vulnerability that can crash the routing protocol daemon (rpd) when a non-default 'aggregate-label' labeled-unicast BGP setting is configured. An established BGP peer can trigger this condition, causing route churn and potential traffic loss, though no confidentiality or integrity impact exists. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; organizations using these Juniper products for critical routing should prioritize mitigation because an unauthenticated (per CVSS PR:N) network-adjacent attacker with BGP peering access could disrupt network availability.
Disable the 'aggregate-label' labeled-unicast setting where not required; limit BGP peering to trusted network-adjacent devices; monitor rpd for crashes and restart events; apply vendor workarounds if available. No vendor patch available; apply mitigations per vendor advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB