CVE-2026-101960 in Junos OS Evolved
Summary
by MITRE • 10/14/2026
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as a critical flaw in the routing protocol daemon, commonly referred to as rpd, within Juniper Networks Junos OS Evolved affects specific hardware platforms including the QFX5240, QFX5241, and QFX5250 series switches. This security issue is specifically triggered when these devices are configured for Border Gateway Protocol global-load-balancing features and manage a configuration involving more than one hundred twenty-eight equal-cost multi-path next-hops. The core technical nature of this flaw is an out-of-bounds write operation, which represents a severe memory corruption vulnerability where the software attempts to write data to a memory location that falls outside the allocated buffer boundaries for the rpd process.
From a technical perspective, the routing protocol daemon serves as the central component responsible for maintaining routing tables and processing dynamic routing protocols such as BGP. When handling complex load-balancing configurations with extensive next-hop lists, the application logic fails to properly validate array indices or memory allocation sizes before performing write operations. This lack of boundary checking allows an attacker who can influence the routing table state, potentially through a maliciously crafted BGP update message from a peer router, to cause the daemon to overwrite adjacent memory structures. Such overwrites can corrupt critical data structures within the process space, leading directly to instability and eventual termination of the rpd service.
The operational impact of this vulnerability is significant due to its potential for denial-of-service attacks against network infrastructure. Since the routing protocol daemon is essential for maintaining connectivity and route propagation across enterprise or carrier networks, a crash in this component results in immediate loss of dynamic routing capabilities. This disruption can lead to traffic blackholing, where packets destined for certain prefixes are dropped because no valid routes exist in the forwarding table until the service restarts. In high-availability environments relying on rapid convergence, such an event causes substantial network downtime and potential data loss during the recovery period. The requirement of having more than one hundred twenty-eight next-hops suggests that this vulnerability is most likely exploitable in large-scale deployments or specific load-balancing scenarios rather than simple point-to-point links.
In terms of industry classification standards, this flaw aligns with CWE-787: Out-of-bounds Write, which describes writing data to a memory location beyond the intended buffer boundary. This type of vulnerability is particularly dangerous as it can sometimes be leveraged for arbitrary code execution if an attacker gains sufficient control over the overwritten memory contents and structure layout. Furthermore, within the context of cyber attack frameworks like MITRE ATT&CK, this exploitation vector relates to techniques involving resource manipulation or denial-of-service actions against network services. The specific trigger mechanism via BGP updates places it in categories related to protocol-level attacks where an adversary interacts directly with routing protocols to disrupt service availability.
Mitigation strategies for this vulnerability primarily involve applying the vendor-provided software patches that address the memory management logic within the rpd component. Administrators should ensure their Junos OS Evolved installations are updated to versions that include fixes for this specific out-of-bounds write condition. In environments where immediate patching is not feasible, network architects can implement workarounds by limiting the number of equal-cost multi-path next-hops per route to fewer than one hundred twenty-eight entries. Additionally, deploying strict BGP filtering policies and restricting peering sessions to trusted peers only reduces the attack surface by preventing untrusted actors from injecting malicious routing updates that could trigger the flawed code path. Regular monitoring for unexpected rpd restarts or log messages indicating memory errors can also aid in early detection of exploitation attempts.