EUVD-2026-101367
GHSA-7wjv-h984-hxwr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent MPLS network position
-
ExploitCraft malformed MPLS-TE FRR signaling
-
ExecutionTrigger numeric truncation in rpd
-
ImpactCrash routing process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Numeric truncation prevention
|
| Exploitation Conditions | Exploitation requires the device to be running MPLS-TE with fast-reroute (FRR) signaling enabled, and the attacker must occupy an adjacent network position (AV:A) able to send or influence MPLS-TE FRR signaling toward the rpd process - not a remote internet-facing path. No authentication is required (PR:N) and no user interaction (UI:N), and default configurations without MPLS-TE FRR are not exposed. Limiting factors: adjacency requirement confines the attacker to the MPLS/routing fabric, and the MPLS-TE FRR feature must be configured, substantially narrowing the realistic exploit population to service-provider and large-enterprise cores. |
| Impact | This is a genuine but bounded availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity attack, but the adjacent (AV:A) vector is the single most important limiting factor: the attacker must be on the same Layer-2/adjacent network segment and be able to participate in or inject MPLS-TE fast-reroute signaling, which in practice means a position inside the routing/MPLS fabric rather than the open internet. Impact is confined to availability (VA:H / SA:L) with no confidentiality or integrity effect, consistent with a routing-daemon (rpd) crash and denial of service rather than code execution. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent mass exploitation; the sole source is the Juniper vendor advisory (JSA112187). Net assessment: real priority for carriers and enterprises running MPLS-TE with fast-reroute, lower priority for deployments that do not enable MPLS-TE FRR. The signals are internally consistent - there is no conflict between the vector and the description - but the absence of exploitation-probability data means risk is inferred from the vector and CWE, not from observed activity. |
| Exploit ScenarioDerived | An attacker with a foothold on an adjacent network segment within the MPLS domain crafts malformed MPLS-TE fast-reroute signaling messages that trigger a numeric truncation error in the rpd routing process. The truncation leads to an unexpected value that crashes rpd, dropping routing adjacencies and causing a denial of service on the targeted router. No public exploit code was identified at time of analysis, and no code execution or data disclosure results - the impact is a routing-process crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
RemediationAI
No exact fixed release is specified in the provided data, so patch status is not confirmed here; treat JSA112187 (https://supportportal.juniper.net/JSA112187) as the authoritative source for the fixed Junos OS and Junos OS Evolved release trains and upgrade to the vendor-designated fixed build for your train once identified. Where immediate upgrade is not possible, the most effective compensating control is to not run MPLS-TE fast-reroute signaling on interfaces reachable by untrusted adjacent devices - disabling FRR (or the TE FRR extensions) on affected routers removes the vulnerable code path entirely, with the trade-off that protected LSPs lose sub-second local protection and must fall back to slower IGP reconvergence, so this should be scoped to links where the adjacency is not fully trusted. A second option is to constrain who can inject signaling: apply interface ACLs/filters and RSVP-TE authentication or policy so only known, trusted peers can source MPLS-TE/RSVP signaling toward rpd, and rate-limit RSVP/TE control messages; the trade-off is operational complexity in large TE meshes and the risk of filtering legitimate reoptimization or FRR traffic if policies are over-tightened. Also enable and monitor rpd core dumps and logging, alert on unexpected rpd restarts, and enforce the general hardening practice of restricting management and routing adjacencies to trusted peers, since the attack fundamentally depends on an attacker gaining a position adjacent to the TE signaling path rather than on remote internet reachability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is rpd, Junos's routing protocol daemon, which runs on the Routing Engine in classic Junos (separate from the Packet Forwarding Engine) and inside the Linux-based control-plane environment in Junos OS Evolved; rpd in both cases handles MPLS traffic-engineering signaling, including RSVP-TE path and reservation messages that carry fast-reroute (FRR) extensions used for local protection of LSPs. CWE-197 (Numeric Truncation Error) describes the root-cause class where a value is silently narrowed when stored or converted to a smaller integer type, so length, offset, or counter arithmetic downstream operates on a corrupted quantity rather than the original. In this case the malformed input arrives via MPLS-TE FRR signaling and causes rpd to fault and restart, which is a control-plane availability failure rather than memory corruption leading to code execution - consistent with the C:N/I:N and A:H scoring in the assessed vector. The CPE data lists broad wildcarded ranges for cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved, meaning the affected release set spans multiple Junos trains and Evolved releases and must be resolved against the vendor advisory rather than assumed from the CPE alone. The attack vector is adjacent (AV:A): the attacker must already sit in or be able to inject into the MPLS-TE signaling path (for example an adjacent PE/P device or a compromised device peering across the TE domain), not reach the device from the public internet, which is the decisive limiting factor on this issue.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent MPLS signaling path gives AV:A, no auth or interaction needed (PR:N/UI:N), and the rpd crash yields availability-only impact (A:H, C/I:N).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved routers configured with MPLS-TE fast-reroute signaling face a high-severity availability risk from an unauthenticated adjacent attacker who can crash the routing process and disrupt network operations. The exposure is limited to environments that enable the affected signaling feature, but where present it can cause control-plane denial of service and dependent business-service outages. Leadership should prioritize inventory and mitigation because core routing availability is directly tied to customer-facing and internal service continuity, even though there is no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict MPLS-TE signaling to trusted adjacent routers using ACLs/firewall filters and control-plane policing; disable MPLS-TE fast-reroute where not required; segment signaling/control plane; monitor rpd process stability and router logs; follow Juniper advisory for future patch and fixed versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB