EUVD-2026-101350
GHSA-2rv8-vh2c-38cw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish or compromise BGP peering session
-
DeliveryCraft malicious BGP route update
-
ExploitTrigger mismatched memory free in rpd SRv6 path
-
ExecutionCrash routing protocol daemon
-
ImpactRouting outage / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory management consistency
|
| Exploitation Conditions | Exploitation requires the target Junos OS / Junos OS Evolved device to have BOTH extended next-hop tunneling AND SRv6 service processing configured - a non-default, service-provider-oriented feature combination; devices without this configuration are not affected. The attack is delivered through a BGP route update, which requires an established BGP peering relationship with the target (the description characterizes the attacker as authenticated/network-based, though the CVSS vector lists PR:N). Impact is limited to availability (rpd crash / routing DoS) with no confidentiality or integrity loss; the narrow configuration dependency is the primary limiting factor on real-world exposure. |
| Impact | This is a CVSS 4.0 8.7 (High) availability-only flaw (VC:N/VI:N/VA:H) in the Juniper rpd daemon, triggerable via a malformed BGP route update. The CVSS vector scores it AV:N/AC:L/PR:N/UI:N, which would imply trivial remote unauthenticated exploitation; however, the CVE description explicitly states an 'authenticated network-based attacker,' and a BGP route update presupposes an established BGP peering session - a conflict that should be resolved with Juniper before treating this as truly pre-auth. The vector's AU:Y (Automatable=Yes) supplemental flag suggests reliable triggering once a session exists, but real-world risk is sharply gated by the requirement that BOTH extended next-hop tunneling AND SRv6 service processing be configured, which is a non-default, provider-grade feature combination. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis; combined with the narrow configuration prerequisite, this reads as a legitimate patch priority for SRv6-enabled service-provider edges but NOT a broad, internet-wide emergency. Treat as high priority only for operators running SRv6 with extended next-hop tunneling; lower priority elsewhere. |
| Exploit ScenarioDerived | An attacker controlling (or able to inject into) a BGP peering session with a vulnerable Junos/Junos Evolved router crafts a malicious BGP route update that exercises the extended next-hop tunneling and SRv6 service-processing code path in rpd. The mismatched memory management routine (CWE-762) corrupts memory and crashes the rpd process, disrupting routing and causing a denial of service. No public proof-of-concept is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Juniper Networks Junos OS and Junos OS Evolved can have their routing protocol daemon (rpd) crashed by a crafted BGP route update, producing a routing-layer denial of service on devices that combine extended next-hop tunneling with SRv6 service processing. Only deployments with both of these non-default, service-provider-oriented features active are exposed, and the traffic must arrive over an established BGP peering session, so real-world exposure is narrow; the impact is availability-only with no confidentiality or integrity loss. No public exploit code and no CISA KEV entry were identified at time of analysis, and the referenced Juniper advisory (JSA112187) is the authoritative source for affected versions.
RemediationAI
No vendor-released patch version was identifiable from the supplied data, so the first action is to pull the official Juniper advisory at https://supportportal.juniper.net/JSA112187 (JSA112187) and apply the fixed Junos OS or Junos OS Evolved release listed there for the relevant release train as soon as it is published or already available; upgrades to non-affected trains are the definitive fix because this is a memory-management defect in rpd that cannot be corrected by configuration alone. Where an immediate upgrade is not possible, the most effective compensating control is to remove the vulnerable code path: disable extended next-hop tunneling and/or SRv6 service processing on the affected routing instances, with the trade-off that any SRv6-based transport or segment-routing service relying on those features will stop working, so this is only viable for devices where those capabilities are not currently in production use. Additional containment is to harden the BGP attack surface by restricting BGP peering to explicitly trusted neighbors with TCP-MD5 or TCP-AO authentication and by applying firewall filters or lo0/interface filters that accept BGP (TCP 179) only from known peer addresses, accepting that this reduces but does not eliminate risk because any permitted peer can still deliver the triggering update. Operators should also monitor rpd for crashes and unexpected restarts (for example via core files or routing-process restart logs) as a detection signal while awaiting the fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-762, Mismatched Memory Management Routines, meaning memory obtained through one allocation path is later released or handled by an incompatible routine inside the rpd process. Juniper's rpd implements BGP and related routing protocols on both the classic Junos OS FreeBSD-based platform and the Linux-based Junos OS Evolved, and both code bases are listed in the affected CPE set (cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved). The triggering path involves BGP updates carrying extended next-hop tunneling information that is then consumed by SRv6 (Segment Routing over IPv6) service processing, an interaction between two advanced, opt-in routing features. Because SRv6 and extended next-hop tunneling are typically enabled only in service-provider or large-enterprise cores, the vulnerable code path is not reached on default or typical enterprise configurations. The provided CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and SA:L, i.e. an availability-predominant network attack; our independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:L/A:H, reflecting the non-default configuration prerequisite and the need for an established BGP relationship with the target.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Requires an established BGP peer (PR:L per description's 'authenticated') and a non-default SRv6/extended-next-hop configuration (AC:H); availability-only impact (A:H).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved deployments that combine extended next-hop tunneling with SRv6 service processing are vulnerable to a routing-layer denial-of-service attack that can crash the routing protocol daemon (rpd). This affects only service-provider-oriented configurations with both non-default features enabled, but successful exploitation could disrupt network routing and cause outages for downstream customers. While no public exploit identified at time of analysis, organizations should treat this as a priority due to the criticality of network availability.
Disable extended next-hop tunneling and/or SRv6 service processing if not operationally required; restrict BGP peering to trusted peers; monitor rpd logs for crash indications; implement redundant routing paths.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB