EUVD-2026-101329
GHSA-rfq4-rw8r-q64x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network position
-
DeliveryEstablish LDP session with device
-
ExploitSend crafted IPv6 Prefix FEC Label message
-
ExecutionTrigger reachable assertion in rpd
-
Impactrpd daemon crash, routing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires (1) an attacker with adjacent network access to the device (AV:A - same L2 segment or directly connected routing peer, not arbitrary internet reach), and (2) an established LDP (Label Distribution Protocol) session with the target, meaning LDP must be configured and enabled on the Junos OS / Junos EVO device and willing to peer. The trigger is a specific LDP Label message carrying an IPv6 Prefix FEC, so the device must be processing IPv6 FEC bindings over LDP. Limiting factors: the adjacency requirement and the need for an active LDP session substantially narrow the attacker population; no authentication is required once LDP peering is reachable (PR:N), and no user interaction is needed (UI:N). Devices without LDP enabled, or not exchanging IPv6 Prefix FECs, are not exposed. Impact is limited to availability (rpd crash); the daemon's automatic recovery (R:A) further bounds the outage per crash. |
| Impact | This is a moderate-severity, availability-only denial-of-service issue (CVSS 4.0 base 7.1, CWE-617 Reachable Assertion). The signals are internally consistent and point to a bounded, not widespread, threat: the vendor-supplied CVSS 4.0 vector is AV:A (adjacent, not network-routable), AC:L, PR:N, UI:N with impact limited to VA:H (vulnerable-system availability) plus SA:L (subsequent-system availability), and VC/VI/VA for confidentiality and integrity all N - so there is no code execution or data exposure, only a crash of the rpd routing daemon. The supplemental metrics reinforce a real but constrained picture: AU:Y (automatable) and V:C (concentrated value) suggest the crash is reliably reproducible against a reachable target, while R:A (automatic recovery, i.e. the daemon restarts) limits persistent damage. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization. Net assessment: this is a legitimate patch-worthy issue for exposed routing infrastructure but NOT an emergency - the adjacency requirement (attacker must be on the same L2/routing segment and hold an established LDP session) is the single biggest limiter and keeps this well below the priority of a remote unauthenticated RCE. Key missing data: exact affected/fixed Junos version trains (CPE uses wildcards) and EPSS/exploit-maturity signals. |
| Exploit ScenarioDerived | An attacker positioned on an adjacent network segment establishes an LDP session with a vulnerable Junos OS or Junos EVO device and sends a specifically crafted Label message carrying an IPv6 Prefix FEC. Processing this message trips a reachable assertion in the rpd routing-protocol daemon, crashing it and disrupting routing (a denial of service). No public exploit code has been identified at time of analysis, and the AV:A/AC:L profile means the attack is low-complexity once the required adjacency and LDP session exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
RemediationAI
Apply the fixed Junos OS or Junos OS Evolved release identified in the vendor advisory JSA112187 (https://supportportal.juniper.net/JSA112187); because the input data provides no exact fixed version strings, the specific patched release must be read from that advisory rather than assumed, and no vendor-released patch version is confirmed from the intelligence supplied here. Juniper advisories of this class typically publish per-release-train fixed versions and a workaround section, so the advisory should be treated as the primary source for both the upgrade target and any interim configuration guidance. Where an immediate upgrade is not possible, reduce exposure by tightening who can form an LDP adjacency with the device: apply GTSM/TTL-security and LDP MD5 authentication, and use firewall filters to permit LDP (UDP/TCP port 646) only from explicitly trusted directly connected peers, accepting that mis-scoped filters will break legitimate LDP sessions and cause label-switched path churn. If IPv6 label distribution over LDP is not required, removing the inet6 family from the relevant LDP interfaces eliminates the IPv6 Prefix FEC trigger path, at the cost of losing IPv6-over-MPLS label bindings and any services that depend on them. Note that rpd restarts automatically after the assertion, so each crafted message yields a bounded outage rather than a permanent failure, but repeated messages can sustain intermittent routing disruption until the patch or a filtering control is in place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is rpd, the Junos routing protocol daemon, which implements Label Distribution Protocol (LDP) and, per RFC 7552, the IPv6 address-family extensions that allow IPv6 Prefix FECs to be advertised as label bindings over an LDP session. The root cause is CWE-617 (Reachable Assertion): when rpd processes a specific Label message whose IPv6 Prefix FEC content violates an internal assumption, an assertion is triggered and the daemon aborts rather than handling the input gracefully. Because the trigger arrives over an already-established LDP session, the attack surface is a routing adjacency rather than an arbitrary internet-facing service. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, R:A) and the independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that exploitation requires adjacent network access, no privileges, and no user interaction, and that the sole impact is high availability loss to the affected device with low subsequent-system availability impact; the R:A metric reflects that rpd's automatic restart constrains the downtime per crash. Both Juniper Networks Junos OS and Junos OS Evolved are affected per the supplied CPE entries (cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:* and cpe:2.3:a:juniper_networks:junos_os_evolved:*:*:*:*:*:*:*:*), which do not pin specific version ranges and therefore defer release-train granularity to the vendor advisory.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent LDP peer with no auth gives AV:A/AC:L/PR:N/UI:N; impact is a routing-daemon crash so A:H with C:N/I:N and scope unchanged.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.
Executive ViewAI
Juniper Junos OS and Junos OS Evolved routing platforms that run the rpd daemon and participate in LDP with IPv6 Prefix FEC can suffer a network-adjacent denial-of-service condition that interrupts routing availability. The flaw is limited to availability, requires an existing LDP session with a directly connected or Layer 2-adjacent peer, and the daemon’s automatic restart limits each disruption. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should direct inventory and interim containment for affected network segments while awaiting a fix.
No vendor-released patch identified at time of analysis; interim mitigations include disabling LDP IPv6 Prefix FEC where not required, restricting LDP adjacencies to trusted directly connected peers, segmenting Layer 2 domains, monitoring rpd restart events, and applying any Juniper workaround from the vendor advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB