Junos OS EUVD-2026-101435

Exploitation requires network reachability to the na-grpcd gRPC daemon AND valid low-level authentication credentials (CVSS PR:L) - gRPC/management access is not available to fully unauthenticated attackers by default. The specific trigger is a highly compressed gRPC request that the bundled gRPC library's decompression handling fails to bound (CWE-409). Limiting factors: the gRPC/na-grpcd service must be enabled and exposed to the attacker's network position, the attacker must already possess valid credentials for that interface, and the affected device must run one of the vulnerable Junos OS trains (e.g., below 23.2R2-S7.7, 24.4R2-S5, 25.4R1-S3, 26.2R1-S2, among the listed ranges). Impact is limited to denial of service of the targeted daemon/system; there is no confidentiality or integrity compromise.

This is a moderate-priority availability issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, 7.1) indicates a network-reachable, low-complexity attack that nonetheless requires valid low-level privileges (PR:L), with impact confined to availability (VA:H on the vulnerable system plus a minor SA:L subsequent-system effect) and no confidentiality or integrity loss. The CWE-409 (Improper Handling of Highly Compressed Data) classification is consistent with a decompression-bomb/resource-exhaustion DoS against the na-grpcd daemon. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation is not demonstrably active or trivial for an unauthenticated outsider. The authentication requirement (PR:L) is the single most important mitigating signal: an attacker must already hold valid gRPC/management-plane credentials, which substantially narrows the realistic threat to insiders or post-compromise lateral movement rather than mass internet exploitation. Signals are internally consistent - no conflicts between the vector, description, and CWE - so this reads as a genuine but credential-gated availability risk, not a high-CVSS-but-hollow finding, and not a drop-everything externally-exploitable flaw.

An attacker holding valid, low-privilege gRPC management credentials sends a specially crafted, highly compressed gRPC request to the na-grpcd service on a Junos OS device. The daemon expands the compressed payload disproportionately, exhausting memory or CPU and causing a denial of service against the management/telemetry channel. No public exploit code was identified at time of analysis, and because PR:L is required, the attacker must first be authenticated to the gRPC interface.