Junos OS EUVD-2026-101447

Exploitation requires that SRv6 dynamic tunnels be explicitly enabled on the device (a non-default feature configuration) AND that the attacker hold an established BGP peering session with the target, from which a malformed BGP-signaled SRv6 service route can be advertised. These two preconditions are the primary limiting factors: devices without SRv6 dynamic tunnels configured, or without a BGP session reachable by the attacker, are not exposed. There is no user-interaction or credential requirement (PR:N/UI:N) once a BGP adjacency exists, so any neighbor able to send routes to the affected rpd can trigger the crash; impact is limited to availability (routing daemon crash and routing disruption).

This is a credible but conditional denial-of-service issue, not a code-execution or data-breach risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows a network-reachable, low-complexity, unauthenticated trigger, but the impact is confined to availability (VA:H, with SA:L for routing fallout) - confidentiality and integrity are untouched (VC:N/VI:N). The 8.7 score is driven almost entirely by the availability impact on a core routing component (rpd), so treat it as a high-impact-but-scoped outage risk rather than a system-compromise risk. Crucially, real-world exposure is gated by two preconditions the raw score does not reflect: SRv6 dynamic tunnels must be enabled, and the attacker must already be an established BGP peer. No EPSS score, KEV listing, or public POC was provided, and no public exploit identified at time of analysis - so there is no evidence of active or imminent widespread exploitation. The PR:N rating is technically correct (BGP has no user authentication) but understates the trust precondition: only a configured, established BGP neighbor can deliver the malformed route, which in practice limits the realistic attacker set to peers/adjacent networks. Priority should be high for operators running SRv6 dynamic tunnels at network edges with external BGP peers, and low-to-moderate for everyone else.

An attacker who controls or compromises a BGP neighbor of a Junos OS/Junos OS Evolved device that has SRv6 dynamic tunnels enabled advertises a specially malformed BGP-signaled SRv6 service route. The rpd routing daemon fails to properly validate a quantity field in the input and crashes, dropping routing adjacencies and disrupting traffic forwarding. No public exploit identified at time of analysis, and because the trigger is low-complexity once a BGP session exists, repeated advertisements can produce a sustained denial of service.