CVE-2026-101944 in Junos OS
Summary
by MITRE • 10/15/2026
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability resides within the routing protocol daemon, commonly referred to as rpd, which is a core component of Juniper Networks Junos OS and Junos OS Evolved operating systems. This specific flaw manifests as an integer overflow or wraparound condition during the processing of Extended Community attributes associated with Ethernet Virtual Private Network routes. The security issue arises when the system attempts to parse and validate route updates received from a BGP peer that has already been authenticated and accepted into the routing table. Because the vulnerability is triggered by specially crafted EVPN route advertisements, it highlights a critical gap in input validation logic within the protocol handling subsystems responsible for managing complex network overlay configurations.
From a technical perspective, integer overflow vulnerabilities occur when an arithmetic operation results in a value that exceeds the maximum capacity of the allocated data type, causing the number to wrap around to a minimum or negative value rather than throwing an exception. In this context, the rpd likely fails to properly check bounds before performing calculations related to route attributes or memory allocation based on those attributes. When an attacker sends malformed EVPN updates containing specific extended community values designed to trigger this arithmetic error, the resulting miscalculation can lead to buffer overflows, invalid pointer dereferences, or other critical memory corruption issues within the daemon process. This type of flaw is particularly dangerous in network infrastructure software because it allows remote exploitation without requiring prior authentication for the initial payload delivery, provided the BGP session is established and accepted by the device.
The operational impact of this vulnerability centers on a severe denial of service condition affecting the affected Juniper devices. By exploiting this integer overflow, an attacker can cause the routing protocol daemon to crash or become unresponsive. Since rpd manages dynamic routing protocols including BGP, OSPF, and IS-IS, its failure disrupts the device's ability to maintain routing tables and forward traffic correctly. This leads to a loss of connectivity for networks relying on these devices as routers or gateways. The impact is not limited to local disruption; in large-scale network topologies, the instability caused by such crashes can trigger route flapping, convergence delays, or complete isolation of network segments, thereby degrading overall service availability and reliability for end-users dependent on the infrastructure.
This vulnerability aligns with CWE-190, which defines integer overflow or wraparound errors as a class of software weaknesses where arithmetic operations produce results that exceed the maximum value representable by the data type. Furthermore, from an offensive security perspective, this exploit vector corresponds to MITRE ATT&CK technique T1498, specifically Network Denial of Service via resource exhaustion or protocol abuse. The attack requires interaction with a trusted BGP peer, indicating that while it is remote in nature, it relies on the attacker having established a legitimate session with the target device. This underscores the importance of securing peering relationships and validating all incoming routing updates rigorously before processing them within critical system daemons.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software patches or firmware upgrades that address the root cause in the rpd codebase. Organizations running affected versions of Junos OS or Junos OS Evolved should prioritize updating their infrastructure to a version where input validation checks have been strengthened and integer arithmetic operations are safeguarded against overflow conditions. In addition to patching, network administrators can implement strict access control lists on BGP peering sessions to ensure that only trusted peers with known-good configurations can exchange routing updates. Monitoring for unusual patterns in EVPN route advertisements or sudden drops in BGP session stability can also aid in early detection of exploitation attempts while patches are being deployed across the environment.