EUVD-2026-101352
GHSA-57x6-37jg-h5f9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish/compromise eBGP peering session
-
DeliverySend crafted BGP labeled-unicast UPDATE
-
ExploitTrigger incorrect buffer-size calculation in rpd
-
ExecutionCrash routing protocol daemon
-
ImpactRouting/forwarding denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer size calculation
|
| Exploitation Conditions | Exploitation requires two concrete preconditions stated in the description: (1) the attacker must be a configured eBGP neighbor of the target (an established BGP peering relationship, not arbitrary remote access), and (2) the affected BGP multipath features must be enabled on the router, with the trigger delivered via BGP labeled-unicast UPDATE messages. Limiting factors: routers without BGP multipath enabled, or that peer eBGP only with fully trusted/controlled parties, are not realistically exposed; there is no confidentiality or integrity impact, only an rpd crash (availability). The eBGP-peer requirement is the key mitigant despite the PR:N rating in the vendor CVSS. |
| Impact | This is a genuine operational-availability risk for Juniper-based networks, but not an indiscriminate internet-wide threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) with VA:H and subsequent-system SA:L yields 8.7 (High), reflecting a pure denial-of-service impact on the routing protocol daemon with no confidentiality or integrity loss (VC:N/VI:N/VA:H). The supplemental metrics are informative: Automatable:Yes (AU:Y) means the triggering UPDATE could be scripted, but Recovery:Automatic (R:A) and the fact that the attacker must already be a configured eBGP neighbor materially constrain real-world exploitability. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a tension to verify: the CVSS marks PR:N (no privileges), yet the description requires the attacker to be an established eBGP peer AND requires the affected multipath features to be enabled - these are real preconditions that reduce exposure below what PR:N alone implies, so treat this as a priority chiefly for operators who peer eBGP with untrusted/semi-trusted parties and run BGP multipath with labeled-unicast. |
| Exploit ScenarioDerived | An attacker controlling (or who has compromised) a device that is a configured eBGP neighbor of a vulnerable Junos router sends specially crafted BGP labeled-unicast UPDATE messages. On a router where the affected multipath features are enabled, the incorrect buffer-size calculation (CWE-131) triggers an rpd crash, dropping BGP sessions and disrupting routing. No public exploit code was identified in the provided data; the low attack complexity (AC:L) means a validly peered adversary could reproduce the crash reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Malformed BGP labeled-unicast UPDATE messages can crash the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on affected routers (CVSS 8.7). Per the vendor CVSS vector the attack is unauthenticated (PR:N), but exploitation in practice requires two concrete preconditions: the sender must be a configured eBGP neighbor with an established BGP peering session to the target, and the affected BGP multipath features must be enabled on the router, with the trigger arriving as labeled-unicast UPDATEs. Impact is availability only - rpd crashes with no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, so this is primarily an operational-availability risk for Juniper networks that peer eBGP with external or less-trusted parties and run multipath.
RemediationAI
No vendor-released patch version is identified in the available data, so patch status cannot be confirmed from this dataset - Juniper's advisory at https://supportportal.juniper.net/JSA112187 should be consulted for the fixed Junos OS and Junos OS Evolved release trains and applied as the primary remediation once the appropriate maintenance release for each platform is published. Until a fix is deployed, the most targeted compensating control is to remove the exposure condition rather than the whole service: disable the affected BGP multipath features on sessions that carry labeled-unicast traffic, accepting the trade-off of reduced path redundancy and load balancing (and possible loss of MPLS/segment-routing reachability where multipath is used for labeled routes) until the device can be upgraded. Where multipath cannot be disabled, restrict labeled-unicast peering to fully trusted, controlled eBGP neighbors and harden the BGP session itself - apply GTSM/TTL-security (e.g. 'ttl 1' on eBGP), TCP-MD5 or TCP-AO authentication for the peering, and an ingress firewall filter that accepts BGP (TCP/179) only from the configured neighbor addresses - which reduces but does not eliminate the risk from a compromised or misbehaving trusted peer, since the crash is triggered by well-formed protocol messages from a legitimate session. Routing-protocol graceful restart and non-stop active routing can shorten the outage caused by an rpd crash but are only recovery measures, not mitigations of the underlying defect, and should be verified as functional before relying on them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an Incorrect Calculation of Buffer Size (CWE-131) inside rpd, the Junos routing protocol daemon that implements BGP and other routing protocols. When the affected BGP multipath features are active, processing of BGP labeled-unicast UPDATE messages causes rpd to compute a buffer size incorrectly, leading to memory corruption that terminates the daemon and disrupts routing on the device. Labeled-unicast is the BGP address family that carries MPLS labels, commonly used for inter-AS and carrier-style MPLS/segment-routing designs, so the vulnerable code path is exercised on networks that exchange labeled routes across eBGP sessions. Juniper's CPE data identifies the affected platforms as junos_os and junos_os_evolved (cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved), i.e. both the classic FreeBSD-based Junos OS and the Linux-based Junos OS Evolved code lines. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a purely availability-focused outcome with high impact to the daemon; the vendor's CVSS 4.0 vector adds only a low subsequent-system availability impact (SA:L), meaning the crash can ripple to dependent routing/forwarding behavior but is not scored as a confidentiality or integrity compromise.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Network-reachable via BGP with low complexity against an enabled multipath config; attacker is a peer rather than an authenticated principal so PR:N; impact is availability-only (rpd crash).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.
Executive ViewAI
A denial-of-service vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows malformed BGP labeled-unicast UPDATE messages to crash the routing protocol daemon (rpd), potentially taking affected routers offline and disrupting network traffic for all services that depend on them. Although the flaw is rated unauthenticated at the protocol level, a successful attack requires the sender to already hold an established eBGP session with the target router and for BGP multipath features to be enabled, which narrows the realistic threat to externally peered routers or untrusted peering relationships. No vendor patch is currently available and no public exploit code has been identified, so leadership should treat this as an operational-availability risk requiring interim hardening and heightened monitoring rather than an imminent compromise risk.
No vendor-released patch is available at time of analysis. Interim mitigations: temporarily disable BGP multipath features on Junos OS and Junos OS Evolved routers that peer with external or untrusted eBGP neighbors; restrict and monitor which eBGP neighbors are configured on affected routers; apply inbound route filtering and prefix/route limits on untrusted eBGP sessions; monitor for rpd crashes or restarts and BGP session flaps; and engage Juniper support for interim mitigation guidance or a hotfix until a vendor patch is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB