CVE-2026-101945 in Junos OS
Summary
by MITRE • 10/15/2026
An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical integer overflow or wraparound flaw within the rpd process, which serves as the Routing Protocol Daemon in Juniper Networks Junos OS and Junos OS Evolved environments. This specific defect is located deep within the logic responsible for processing Ethernet Virtual Private Network (EVPN) Border Gateway Protocol (BGP) routes. The root cause stems from improper validation of numerical values during arithmetic operations, allowing an attacker to manipulate input data such that it exceeds the maximum limit of a variable's storage capacity. When this threshold is breached, the value wraps around to a negative number or zero instead of triggering an error condition, leading to unpredictable behavior within the routing engine and potentially causing memory corruption or infinite loops depending on how subsequent logic handles these malformed values.
Exploitation of this vulnerability requires a remote attacker who has already established a valid EVPN BGP peering relationship with the affected device. This prerequisite implies that the attacker must possess legitimate credentials or have bypassed authentication mechanisms to initiate the BGP session, which aligns with privilege escalation scenarios where an insider threat or compromised peer is involved. Once the connection is active, the attacker can craft specific malicious BGP route advertisements containing specially crafted attributes or path vectors that trigger the integer overflow during processing. By sending these malformed routes, the attacker forces the rpd process to perform invalid calculations, which destabilizes the control plane operations of the router.
The operational impact of this flaw is severe, primarily manifesting as a denial of service condition for network services relying on EVPN infrastructure. The instability caused by the integer overflow can lead to crashes or restarts of the routing protocol daemon, resulting in the loss of BGP adjacencies and subsequent disruption of traffic forwarding paths. In enterprise networks utilizing VXLAN overlays with EVPN control planes, such disruptions can cause widespread connectivity issues, packet loss, and service outages for critical applications that depend on stable Layer 2 or Layer 3 virtualized environments. The impact is particularly acute because the rpd process manages multiple routing protocols simultaneously; a failure in this component can cascade into broader network instability affecting both control plane signaling and data plane forwarding efficiency.
From a classification perspective, this vulnerability maps directly to CWE-190 Integer Overflow or Wraparound, which describes situations where an integer calculation results in a value that cannot be represented by the allocated storage space. Furthermore, it aligns with MITRE ATT&CK technique T1498 Network Denial of Service, specifically sub-techniques involving resource exhaustion through protocol abuse. The attack vector is classified as remote but requires authentication or peering trust, placing it in a higher privilege tier than unauthenticated exploits yet still posing significant risk to network integrity.
Mitigation strategies should focus on both immediate remediation and long-term architectural hardening. Juniper Networks has released software updates that patch the integer overflow logic within the rpd process; administrators are strongly advised to apply these patches immediately upon availability for their specific version of Junos OS or Junos OS Evolved. In addition to updating, network operators should implement strict BGP route filtering policies using prefix lists and community matching to restrict which routes are accepted from EVPN peers. This limits the attack surface by ensuring that only validated and expected route advertisements are processed by the routing engine. Furthermore, enabling BGP graceful restart features can help maintain forwarding continuity during brief control plane disruptions caused by such incidents, although this does not prevent the initial exploit but rather mitigates its impact on traffic flow. Regular auditing of peering relationships and enforcing mutual authentication mechanisms like MD5 or TCP-AO for BGP sessions also reduces the likelihood of unauthorized peers attempting to trigger this vulnerability.