Description
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.

This issue does not affect Junos OS versions prior to 22.1R1.
This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.
Published: 2026-10-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via stack buffer overflow
Action: Immediate Patch
AI Analysis

Impact

A stack‑based buffer overflow in the routing protocol daemon (rpd) allows an attacker who can send a crafted BGP route attribute to crash the process. The crash occurs only when a BGP RIB streaming telemetry subscription is active, resulting in a denial of service for the affected router. The vulnerability does not grant code execution or compromise control, but it can disrupt routing services and lead to network outages.

Affected Systems

Juniper Networks Junos OS and Junos OS Evolved are affected. All releases from 23.2R2-S7.7 through 26.4R1 and subsequent iterations for Junos OS, and from 23.2R2-S7.7-EVO through 26.4R1-EVO and succeeding releases for Junos OS Evolved, are vulnerable. Versions prior to 22.1R1 (for both products) and the specified earlier releases are not impacted.

Risk and Exploitability

The CVSS base score of 8.7 indicates high severity. EPSS < 1% indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The attack requires a valid BGP peering session, meaning the attacker must have network connectivity to the router and be able to send BGP route updates. The lack of a known workaround means patching is the sole defense.

Generated by OpenCVE AI on October 15, 2026 at 15:29 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Apply the latest Junos OS releases (23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1) or the corresponding Junos OS Evolved updates (23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO) or any subsequent releases.
  • Disable BGP RIB streaming telemetry on affected devices to eliminate the trigger for the crash.
  • Restrict BGP peering sessions to trusted, authenticated peers and apply network segmentation to limit an attacker’s reach.

Generated by OpenCVE AI on October 15, 2026 at 15:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved
Vendors & Products Juniper Networks
Juniper Networks junos Os
Juniper Networks junos Os Evolved

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.
Title Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M'}

Subscriptions

Juniper Networks Junos Os Junos Os Evolved
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-14T19:05:07.362Z

Reserved: 2026-09-28T18:17:13.470Z

Link: CVE-2026-102180

cve-icon Vulnrichment

Updated: 2026-10-14T19:04:24.587Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:05.923

Modified: 2026-10-15T16:23:06.250

Link: CVE-2026-102180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T01:00:13Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow