Description
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.
Published: 2026-10-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability stems from an improper validation of a quantity specified in OSPF packets, a weakness that can lead to a buffer access beyond the end of the buffer (CWE-1284). When an adjacent OSPF peer sends a malformed packet, Juniper’s routing daemon rpd can expose its memory contents or crash, leading to a service interruption on affected devices.

Affected Systems

Juniper Networks Junos OS and Junos OS Evolved have issues across all 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, 26.2, and 26.4 releases. Updated releases that contain the fix are listed as 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases for Junos OS, and the corresponding EVO releases 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

Risk and Exploitability

The CVSS base score of 7.1 indicates high severity. EPSS of less than 1% shows a very low exploitation probability, yet the flaw can be leveraged locally by an adjacent OSPF peer on a link employing TE processing. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers would need to send specially crafted OSPF packets; remote privileges are not required, making it a moderate-to-high risk for networks with OSPF enabled.

Generated by OpenCVE AI on October 30, 2026 at 01:29 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

If OSPF packet processing on an enabled interface isn't needed, but it has just been configured so that it's added to the LSDB, ensure it's configured as 'passive': [ protocols ospf area <area> interface <interface> passive ] The rpd crash only occurs with [ protocols ospf traceoptions flag lsa-update detail ] configured, so removing that line will prevent this.

OpenCVE Recommended Actions

  • Update the device to a Junos OS or Junos OS Evolved release that includes the fix, such as 24.2R2-S5.5 or any later revision listed by Juniper.
  • If patching is not immediately possible, configure any OSPF interface that is not needed for routing as passive to prevent it from entering the LSDB.
  • Remove the traceoptions flag lsa-update detail from the OSPF configuration, because the crash only occurs when this option is enabled.

Generated by OpenCVE AI on October 30, 2026 at 01:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Thu, 29 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1284

Mon, 19 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Wed, 14 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.
Title Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-29T12:08:35.753Z

Reserved: 2026-09-28T16:31:35.503Z

Link: CVE-2026-101974

cve-icon Vulnrichment

Updated: 2026-10-14T20:16:24.805Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:17:50.037

Modified: 2026-10-29T13:17:02.487

Link: CVE-2026-101974

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T01:30:06Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input