Description
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.
Published: 2026-10-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an Improper Validation of Specified Quantity in Input flaw in the routing protocol daemon (rpd). A malformed BGP‑signaled SRv6 service route, when SRv6 dynamic tunnels are enabled, can cause the rpd to crash. The crash results in a denial of service, disabling routing services and impacting network availability. The weakness is categorized as CWE‑1284.

Affected Systems

Affected products are Juniper Networks Junos OS and Junos OS Evolved. Affected releases include Junos OS 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases; and Junos OS Evolved 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all later releases.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS score of 0.0046 (less than 1%) shows that exploitation probability is low, but the vulnerability remains a serious concern. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly reported exploitation to date. The attack vector is remote and requires an unauthenticated BGP peer to send a malformed SRv6 service route. Successful exploitation leads to a crash of the routing protocol daemon, resulting in local denial of service on the device.

Generated by OpenCVE AI on October 15, 2026 at 18:09 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS release 24.2, and Junos OS Evolved release 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS or Junos OS Evolved to one of the listed patched releases (e.g., 26.4R1 or later for the OS, 26.4R1‑EVO or later for OS Evolved).
  • If using Junos OS 24.2 or 24.2‑EVO, ensure the platform is on the restored respin or a newer release that includes the fix.
  • After updating, reboot the device to apply the new routing protocol daemon image and verify that SRv6 dynamic tunnels are operational without causing a crash.

Generated by OpenCVE AI on October 15, 2026 at 18:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.
Title Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled
Weaknesses CWE-1284
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T20:46:20.906Z

Reserved: 2026-09-28T17:35:40.523Z

Link: CVE-2026-102065

cve-icon Vulnrichment

Updated: 2026-10-14T20:39:37.135Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:02.173

Modified: 2026-10-15T16:23:06.250

Link: CVE-2026-102065

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T01:30:14Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input