Juniper Junos OS EUVD-2026-101349

Exploitation requires the extended-nexthop-tunnel feature to be explicitly enabled (a non-default configuration) on the target Junos OS / Junos OS Evolved device, AND the attacker must be an established BGP peer - the description specifies an 'authenticated BGP peer,' meaning a configured BGP neighbor relationship with the target rpd is a prerequisite. Once those conditions hold, the attacker sends crafted BGP route updates that trigger the integer overflow. Limiting factors: devices without extended-nexthop-tunnel enabled are not affected, and the attacker must already occupy or compromise a trusted BGP peering position, which significantly narrows the realistic attack surface despite the network attack vector. Note the vendor vector lists PR:N, which conflicts with the described authenticated-peer requirement.

The vendor CVSS 4.0 base score of 8.7 (High) is driven almost entirely by a high availability impact on the vulnerable system (VA:H) plus a low subsequent-system availability impact (SA:L), with no confidentiality or integrity exposure - consistent with a routing-daemon crash rather than code execution or data theft. No EPSS probability, CISA KEV entry, or public POC was supplied, so there is no evidence of active or imminent widespread exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. A key conflict must be flagged: the vendor CVSS vector states PR:N (no privileges) while the description explicitly requires an 'authenticated BGP peer,' which implies the attacker must already hold an established, configured BGP peering relationship with the target - verify the true privilege requirement with Juniper, as this materially changes the attacker-prerequisite picture. Exploitation is further gated by the non-default extended-nexthop-tunnel feature being enabled. Net assessment: this is a credible operational-availability risk for carriers and enterprises running BGP with that feature, but it is not a drive-by, fully-unauthenticated internet-wide threat - realistic risk is bounded to environments with the feature enabled and reachable/compromised BGP neighbors, making it a targeted rather than mass-exploitation concern pending exploitation data.

An attacker who controls or has compromised a configured BGP peer of a Junos OS or Junos OS Evolved device with extended-nexthop-tunnel enabled sends specially crafted BGP route updates. These updates trigger an integer overflow (CWE-190) in the routing daemon (rpd), crashing it and causing a denial of service that disrupts routing on the affected device. No public exploit code has been identified; given AV:N/AC:L the update itself is simple to send once a peering session exists.