Description
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
Published: 2026-10-14
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow exists in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd). When a remote, configured BGP peer sends a flow‑spec update that is subsequently re‑advertised, the overflow can be triggered. On Junos OS the flaw leads to remote code execution, while on Junos OS Evolved it causes rpd to crash, potentially leading to a denial of service.

Affected Systems

This issue affects Juniper Networks products Junos OS and Junos OS Evolved across a range of releases. For Junos OS the vulnerable releases include 23.2, 23.4, and 24.2, and subsequent updates such as 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases. For Junos OS Evolved the affected releases include 23.2, 23.4, and 24.2 as well as follow‑through releases such as 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity vulnerability that permits remote code execution on Junos OS and can cause a crash on Junos OS Evolved when a remote, configured BGP peer sends a crafted flow‑spec update that is subsequently re‑advertised. The EPSS score of 0.00568 (about 0.6%) indicates a very low exploitation probability, yet the high CVSS score reflects a severe risk. The vulnerability is not listed in CISA's KEV catalog, but its severity remains high. Attackers need to be a trusted BGP neighbor that can send flow‑spec updates; once the overflow is triggered the rpd process can become compromised or crash, potentially impacting routing and availability.

Generated by OpenCVE AI on October 15, 2026 at 17:54 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade all Juniper Networks Junos OS devices to a protected release such as 23.2R2-S7.7 or later, and upgrade Junos OS Evolved devices similarly to releases such as 23.2R2-S7.7-EVO or later, to address the buffer overflow in the routing protocol daemon.
  • As a temporary mitigation, restrict or disable flow‑spec advertisements from untrusted BGP peers until the patch is applied, ensuring that only legitimate, trusted neighbors can send flow‑spec updates.
  • Continuously monitor rpd logs and system availability for signs of crashes or anomalous behavior that could indicate exploitation of the vulnerability.

Generated by OpenCVE AI on October 15, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Juniper
Juniper junos
Juniper junos Os Evolved
CPEs cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2-s8:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:25.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:26.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:26.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos:26.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s6:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s7:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2-s8:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.4x100:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2-s5:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2-s4:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:24.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d10:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d20:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d21:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d22:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.2x100:d30:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4x300:d10:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:25.4x300:d30:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:26.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:26.2:r1:*:*:*:*:*:*
Vendors & Products Juniper
Juniper junos
Juniper junos Os Evolved

Sat, 17 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
Title Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Juniper Junos Junos Os Evolved
Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-16T14:18:52.418Z

Reserved: 2026-09-28T16:31:35.504Z

Link: CVE-2026-101990

cve-icon Vulnrichment

Updated: 2026-10-16T14:18:20.611Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-14T17:17:51.587

Modified: 2026-10-30T18:42:14.243

Link: CVE-2026-101990

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T23:45:13Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow