CVE-2026-101951 in Junos OS
Summary
by MITRE • 10/14/2026
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as an Improper Validation of Consistency within Input affects the routing protocol daemon, known as rpd, in Juniper Networks Junos OS and Junos OS Evolved operating systems. This flaw resides specifically within the processing logic for Border Gateway Protocol (BGP) updates that carry Multiprotocol BGP extensions, particularly those related to multicast tree information. The core technical issue stems from a failure in the input validation mechanisms when handling Network Layer Reachability Information associated with MCAST-TREE advertisements. When a network-adjacent configured BGP peer sends a specifically malformed update packet containing this NLRI, the rpd process attempts to parse and subsequently readvertise the data without adequately verifying its structural integrity or logical consistency. This lack of rigorous validation allows maliciously crafted packets to trigger internal errors within the daemon's processing pipeline.
From an operational perspective, the immediate impact of exploiting this vulnerability is a denial of service condition affecting the routing engine on the affected device. Because the flaw causes the rpd process to fail when encountering these malformed updates, it can lead to a crash or restart of the routing protocol daemon. In Juniper Networks environments where high availability and continuous route computation are critical, such an event disrupts BGP session stability and can result in temporary loss of connectivity for routes dependent on that peer relationship. An attacker positioned as a configured BGP neighbor with network adjacency can exploit this condition to destabilize the router's routing table updates, potentially causing broader network instability if multiple peers or critical route reflectors are impacted simultaneously.
This vulnerability is categorized under CWE-20 Improper Input Validation, specifically highlighting failures in checking data for consistency and structural correctness before processing. The attack vector aligns with MITRE ATT&CK technique T1498 Network Denial of Service, as the exploitation aims to disrupt normal network operations by exhausting or crashing a critical system component rather than gaining unauthorized access to data. It is important to note that successful exploitation requires the attacker to be a configured BGP peer, meaning they must have established a legitimate peering session with the target router. This constraint limits the attack surface primarily to trusted partners in inter-domain routing scenarios but remains significant given the trust model inherent in BGP configurations.
Mitigation strategies for this vulnerability involve applying vendor-provided software updates that patch the input validation logic within the rpd process. Administrators should ensure their Junos OS and Junos Evolved installations are updated to versions where this consistency check has been strengthened. Additionally, implementing strict filtering policies on BGP peers can help mitigate risk by dropping malformed packets before they reach the vulnerable processing code. Network operators should also monitor for unusual routing table fluctuations or daemon restarts that may indicate attempted exploitation of this flaw. Regular audits of BGP peer configurations and adherence to best practices for securing BGP sessions, such as using MD5 authentication and prefix filtering, further reduce the likelihood of successful attacks against this specific implementation weakness.