Junos OS EUVD-2026-101399

The target must have EVPN signaling configured with SRv6 carried in route updates, and the attacker must be positioned as a configured EVPN signaling peer of the victim (an established routing adjacency/trust relationship) - it is not exploitable by an arbitrary off-path remote host. The attack then requires sending a single malformed SRv6 structure within an EVPN route update to crash rpd. Limiting factors: devices without EVPN/SRv6 configured are not affected, exploitation requires an existing peering session (so the attacker must own or compromise a peer), and the impact is confined to availability (routing-plane DoS) with no data exposure.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and portrays this as a remotely reachable, unauthenticated, low-complexity flaw, but the impact profile is availability-only (VC:N/VI:N/VA:H) with a partial subsequent-system effect (SA:L) - there is no confidentiality or integrity exposure, so this is strictly a denial-of-service issue. The most important caveat is that the description explicitly requires 'a configured EVPN signaling peer': despite PR:N, exploitation presupposes that the attacker already holds, or has compromised, an established EVPN peering adjacency with SRv6 signaling in use, which is a meaningful positioning requirement that raw PR:N obscures. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.7 reflects potential blast radius (routing-plane DoS on core/edge devices), not demonstrated exploitation. Net: a genuine priority for operators running EVPN/SRv6 fabrics because an rpd crash drops routing adjacencies, but the trusted-peer precondition makes this far less broadly exploitable than the network/unauthenticated metrics suggest - treat it as a patch-promptly item for EVPN-SRv6 deployments rather than an internet-wide emergency.

An attacker who controls or has compromised a device configured as an EVPN signaling peer sends an EVPN route update containing a malformed SRv6 structure to a vulnerable Junos OS or Junos Evolved router. The improper quantity validation in rpd triggers a crash, tearing down routing adjacencies and causing a denial of service. No public exploit code was provided in the available intelligence, and the attacker must already be an established EVPN peer rather than an arbitrary remote host.