EUVD-2026-101481
GHSA-6h4g-6qmf-9pj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise adjacent LDP neighbor
-
ExploitSend crafted LDP message over session
-
ExecutionTrigger reachable assertion in rpd
-
ImpactCrash routing daemon (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | LDP (MPLS Label Distribution Protocol) must be configured and active on the target Junos OS / Junos OS Evolved device, and the attacker must first have compromised a device that holds an established LDP adjacency (neighbor relationship) with the target in order to send the crafted LDP message. Limiting factors: the CVSS vector is AV:A (adjacent network only, not remotely reachable across the internet), impact is confined to availability (an rpd crash / denial of service) with no confidentiality or integrity effect, and the requirement to already control a trusted LDP peer substantially narrows the realistic attacker set. Devices without LDP/MPLS enabled are not exposed. |
| Impact | This is a moderate-priority availability-only vulnerability (CVSS 4.0 base 7.1), not a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) shows the key risk-limiting factor clearly: AV:A means the attack is adjacent-network only, not internet-routable, and impact is confined to availability (VA:H) with no confidentiality or integrity loss. The practical gating factor is the description's phrase 'compromised LDP neighbor' - exploitation presupposes that an attacker already controls a device with an established LDP adjacency to the target, which is a significant prerequisite that CVSS PR:N does not capture. No EPSS score, CISA KEV listing, or proof-of-concept was provided in the input, so exploitation probability cannot be quantified from the data and there is no public exploit identified at time of analysis. The SA:L (subsequent-system availability, low) indicates limited cascading impact beyond the affected router. Net: real but conditional - relevant primarily to MPLS/LDP-enabled service-provider and large-enterprise cores where a peer compromise is plausible, rather than a broadly exploitable remote flaw. |
| Exploit ScenarioDerived | An attacker who has already compromised a router participating in an LDP (MPLS Label Distribution Protocol) adjacency with a Junos OS or Junos OS Evolved device sends a crafted LDP message over the existing session. The malformed message triggers a reachable assertion (CWE-617) in the routing protocol daemon (rpd), causing it to crash and disrupting routing on the target. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Oct 14, 2026
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Earlier versions of this analysis (2)
Crafted LDP messages sent by an already-compromised neighboring router can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service in environments where LDP is running. The flaw is a reachable assertion (CWE-617) scored 7.1 (CVSS 4.0 AV:A/AC:L/PR:N/UI:N/VA:H; the independent assessment concurs at CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:C/VA:H), and exploitation is constrained to adjacent LDP peers: the attacker must first control an established LDP neighbor, so an arbitrary off-path Internet attacker cannot reach the vulnerable code path. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and no EPSS value was provided, making this a moderate-priority availability issue rather than a critical emergency.
A crafted Label Distribution Protocol (LDP) message sent by a compromised or attacker-controlled LDP neighbor can trigger a reachable assertion in the Junos OS and Junos OS Evolved routing protocol daemon (rpd), causing the daemon to abort and restart - a denial-of-service condition rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is limited to devices that have MPLS/LDP configured and an established LDP peering relationship, since the sender must already be an accepted adjacent LDP peer (adjacent-network attack vector, no additional authentication, no user interaction), and the impact is confined to availability with no data disclosure or code execution. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; Juniper's advisory JSA112187 is the authoritative source for affected release trains and fixed versions.
RemediationAI
Patch availability is not confirmed from the available data, so the first action is to consult Juniper's advisory JSA112187 (https://supportportal.juniper.net/JSA112187) and apply the Juniper-supplied fixed Junos OS or Junos OS Evolved release for each affected platform as soon as it is published; do not assume any specific version number beyond what the vendor advisory states. Where patching is not immediately possible, reduce the attack surface specific to this bug: if MPLS/LDP is not operationally required, disable LDP entirely on the affected routing instances (trade-off: all MPLS label distribution and any services depending on LDP-signalled LSPs stop working). Where LDP must stay enabled, restrict LDP to a minimal, explicitly enumerated set of trusted neighbors using interface and peer filtering so that only known devices can form adjacencies (trade-off: mis-scoped filters can tear down legitimate MPLS sessions and cause an outage), enable LDP session authentication (MD5) to raise the bar for spoofed sessions while recognising that it does not help if an authorised peer is itself compromised, and treat the LDP peer population as part of the trust boundary - segment and harden neighbours so a single compromised router cannot inject malformed LDP messages. Operationally, enable rpd core-dump and crash logging, alert on rpd restart / SNMP daemon-down traps so an attempted or successful crash is detected quickly, and consider routing-engine protection and graceful-restart features so that control-plane churn is survivable; these are compensating controls, not substitutes for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, the CPEs for which (cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved) are wildcarded across the version field, indicating the issue is tracked generically across releases rather than tied to a single build. LDP (Label Distribution Protocol) is the MPLS signalling protocol that distributes label bindings between directly connected LDP peers; a device that has LDP enabled maintains sessions with its neighbors and processes their label advertisement, withdrawal, and notification messages inside rpd. The root cause class is CWE-617 (Reachable Assertion): a crafted LDP message drives rpd into an assert() condition that the code treats as unreachable, so the process aborts. Because rpd is a core Junos daemon responsible for routing protocol state, its crash causes a loss of routing/control-plane function and a Denial of Service for the device, matching the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - adjacent-network attack surface, no privileges required at the protocol level, high availability impact only.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
AV:A because exploitation requires an adjacent LDP peer session; AC:L and PR:N as no target privileges or special conditions beyond the adjacency; impact is availability-only (A:H), so C:N/I:N.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved devices that run LDP/MPLS can have their routing protocol daemon (rpd) crashed by a malformed LDP message, causing a denial-of-service condition on the affected router. The attack is not internet-reachable: it requires the adversary to already control an adjacent device holding an established LDP adjacency with the target, so leadership should treat this as a contained but operationally meaningful availability risk in MPLS-dependent cores. Organizations running LDP at scale in service provider, carrier, or large enterprise networks are most affected because an rpd crash can interrupt forwarding and cascade into customer-facing outages, though no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting LDP traffic to trusted adjacent peers via firewall filters or ACLs, disabling LDP on interfaces where MPLS is not required, enforcing LDP session authentication to limit unauthorized adjacency establishment, segmenting the MPLS control plane from less-trusted network segments, monitoring for rpd crashes and unexpected restarts, and validating graceful restart/nonstop routing and redundant routing engine failover so a daemon crash does not cause an outage. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB