EUVD-2026-101414
GHSA-f96g-6rpj-2gwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish eBGP session without 4-octet-AS capability
-
ExploitSend specifically malformed BGP UPDATE
-
ExecutionTrigger out-of-bounds write in rpd
-
ImpactCrash routing daemon (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be an eBGP peer whose session was established WITHOUT negotiating the four-octet-AS (4-byte ASN, RFC 6793) capability; from that peering the attacker sends a specifically malformed BGP UPDATE. Limiting factors: the device must be running BGP with at least one eBGP neighbor, and that neighbor relationship (or ability to spoof/inject as that peer) is a prerequisite - this is not exploitable by an arbitrary off-path internet host despite PR:N. Affected trains include Junos OS before 23.2R2-S7.7 / 23.4R2-S8.13 / 24.2R2-S5.5 / 24.4R2-S5 / 25.2R2-S2 / 25.4R1-S3 / 26.2R1-S2 and corresponding Junos OS Evolved -EVO builds; upgrading to the fixed release removes the condition. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) rates this 8.7 (High), driven entirely by availability impact (VA:H with a secondary SA:L) and zero confidentiality/integrity impact - consistent with a pure DoS via out-of-bounds write (CWE-787) in the rpd routing daemon. The critical nuance the raw vector understates: although PR:N, exploitation is NOT open to any arbitrary internet host - the attacker must be an established eBGP peer that has specifically NOT negotiated four-octet-AS capability. That adjacency requirement meaningfully narrows the realistic attacker population to a misconfigured/legacy peer or a compromised/malicious directly-configured neighbor, so AC:L somewhat overstates ease in practice. No EPSS score, KEV listing, or POC was provided, so there is no public evidence of active exploitation or weaponized exploit code. This is a genuine priority for operators running BGP-facing Junos devices (routing-plane crash = outage), but the eBGP-peer precondition makes it closer to a targeted/trust-boundary issue than mass-exploitable internet-wide. Note conflict to verify: the vector implies network-wide unauthenticated reach, while the description's eBGP-peer precondition implies a pre-existing trust relationship - treat PR:N with that caveat. |
| Exploit ScenarioDerived | A directly-connected eBGP neighbor (legacy or malicious) that has not negotiated the four-octet-AS capability transmits a specifically malformed BGP UPDATE message to a vulnerable Junos OS or Junos OS Evolved device. Parsing the malformed update triggers an out-of-bounds write in rpd, crashing the routing protocol daemon and causing a denial-of-service/routing outage. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
RemediationAI
Vendor-released patch is available: Juniper's advisory JSA112187 (https://supportportal.juniper.net/JSA112187) identifies fixed builds as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2, with corresponding Junos OS Evolved builds 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO, and 25.4X300-D40-EVO; upgrade to the release matching your installed train and confirm the exact platform image in the JSA before scheduling maintenance. If immediate upgrade is not possible, compensating controls are: restrict eBGP peering to a small, explicitly enumerated set of trusted neighbor addresses via routing-options/authentication and inbound firewall filters scoped to TCP port 179, recognizing that this does not protect against a compromised or spoofed legitimate peer and that filters must be maintained as peers change; temporarily disable BGP (or shut the specific eBGP sessions) on devices that do not require dynamic peering, at the cost of losing dynamic route learning; and, where topologies permit, use only iBGP or confine eBGP sessions to peers confirmed to have negotiated the four-octet-AS capability, though this is a fragile state that can change on session reset and should not be relied on as a long-term fix. BGP MD5/TCP-AO authentication does not mitigate this issue because the malicious UPDATE comes from an established, authorized peer. Monitor rpd core files and BGP session flaps for signs of attempted exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds write (CWE-787) in rpd, the Junos routing protocol daemon that implements BGP and other routing protocols. During BGP session establishment, peers negotiate capabilities, including the four-octet-AS (4-byte ASN) capability defined in RFC 6793; when a peer does not negotiate this capability, the session falls back to the legacy 2-byte ASN encoding path used when parsing BGP UPDATE messages. Juniper's advisory (JSA112187) indicates that a malformed UPDATE delivered over such a session is processed by that legacy parsing logic without adequate bounds checking, allowing an attacker to write past the end of an allocated buffer and corrupt rpd memory, resulting in a daemon crash and loss of routing adjacencies. The affected code exists in both the classic Junos OS FreeBSD-based images and Junos OS Evolved, as reflected by the two CPE entries cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved, which are version-agnostic wildcards covering the full published train ranges listed by EUVD. The CVSS 4.0 vector's VA:H plus SA:L reflects that the primary impact is a hard availability loss on the targeted device with only a low secondary availability effect on downstream routing, while VC/VI/SC/SI are all None - consistent with memory corruption confined to control-plane processing rather than data disclosure or route injection.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Reachable over the network from an eBGP peer with no target privileges (PR:N) and no user interaction; pure availability loss via daemon crash, so C:N/I:N/A:H.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
2DescriptionCVE.org
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).
Executive ViewAI
Juniper Junos OS and Junos OS Evolved contain a high-severity availability vulnerability that can disrupt the BGP routing control plane on devices configured with eBGP neighbors. If exploited by an established or spoofed eBGP peer, it can cause routing daemon crashes or service interruptions, making network resiliency and customer-facing connectivity a leadership concern. Juniper has released fixed builds, and no public exploit or active exploitation has been identified at time of analysis, but unpatched edge routers remain the primary exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB