CVE-2026-101963 in Junos OS
Summary
by MITRE • 10/14/2026
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical flaw within the Routing Protocol Daemon, known as rpd, of Juniper Networks Junos OS and Junos EVO operating systems. This specific defect manifests during the processing of Border Gateway Protocol (BGP) Extended Community for Ethernet Virtual Private Network (EVPN) messages when Segment Routing over IPv6 (SRv6) multihoming configurations are active on the device. The core technical issue stems from an incorrect calculation performed by the daemon when handling certain control plane packets sent by a remote BGP EVPN neighbor. This miscalculation leads to memory corruption or logic errors that ultimately trigger an unhandled exception, resulting in the immediate crash of the rpd process. Because the routing protocol daemon is responsible for maintaining critical routing tables and adjacency states, its termination causes significant disruption to network operations, effectively creating a denial-of-service condition for the affected device.
From a technical perspective, this vulnerability falls under the category of CWE-682, which classifies incorrect calculation errors that can lead to buffer overflows or other memory-related issues depending on the specific implementation details. The attack vector is remote and requires no authentication if BGP peering is established with an untrusted neighbor, although it specifically targets devices configured for SRv6 EVPN multihoming scenarios. This configuration complexity often involves advanced service provider networks where multiple paths are used to ensure redundancy and load balancing across different sites or providers. The attacker exploits the precise sequence of messages exchanged during BGP session establishment or update processing related to Ethernet Auto-Discovery (EAD) routes, causing the daemon to miscalculate resource allocation or state transitions.
The operational impact of this vulnerability is severe for network infrastructure relying on Juniper platforms with SRv6 EVPN multihoming enabled. A successful exploit results in a crash of the rpd process, which typically triggers an automatic restart but causes transient loss of routing information during the downtime. In more complex scenarios or if the daemon fails to recover gracefully, it can lead to prolonged outages, blackholing of traffic destined for specific prefixes, and potential instability across the entire autonomous system due to flapping routes. This affects high-availability architectures where consistent state is paramount, potentially leading to cascading failures in larger network topologies that depend on stable BGP sessions with EVPN extensions.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is the application of vendor-provided software patches or updates released by Juniper Networks that address this specific calculation error within the rpd component. Administrators should verify their current version against known vulnerable releases and schedule maintenance windows to apply fixes promptly. Additionally, network operators can implement access control lists (ACLs) on BGP peers to restrict connectivity only to trusted neighbors, thereby reducing the attack surface for unauthenticated exploitation. Since this vulnerability is triggered by specific SRv6 EVPN multihoming configurations, reviewing whether such complex setups are strictly necessary and simplifying them where possible may also reduce exposure. Monitoring tools should be configured to detect sudden rpd restarts or BGP session drops as indicators of potential exploitation attempts, allowing for rapid incident response before widespread service degradation occurs. This issue aligns with ATT&CK technique T1498, Network Denial of Service, specifically through resource exhaustion via protocol manipulation, highlighting the importance of securing control plane interfaces against malicious input from peer routers.