CVE-2026-101976 in Junos OS
Summary
by MITRE • 10/14/2026
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as CVE-2024-3185 represents a critical security flaw within the routing protocol daemon, known as rpd, of Juniper Networks Junos OS and Junos OS Evolved. This specific defect is classified under Common Weakness Enumeration (CWE) ID 787, which denotes an Out-of-bounds Write condition. The root cause lies in how the BGP implementation processes incoming routing updates from external Border Gateway Protocol peers that have not established four-octet Autonomous System number capability during session negotiation. When such a peer transmits a specifically crafted and malformed BGP update message, the rpd fails to adequately validate the length or structure of certain fields within the packet before attempting to write data into memory buffers associated with routing table entries. This lack of rigorous boundary checking allows an attacker to overwrite adjacent memory locations beyond the intended buffer limits, leading to immediate instability in the daemon process.
From a technical perspective, this vulnerability exploits the parsing logic used for handling AS_PATH attributes or other BGP path vectors where length fields are not strictly validated against allocated memory sizes when four-octet-AS capability is absent. In standard BGP operations using two-byte AS numbers, certain data structures have fixed size expectations. However, if an attacker sends a packet that implies a larger structure than what was negotiated or expected by the parser for non-four-octet sessions, the daemon may attempt to write beyond the allocated stack or heap space. This memory corruption typically results in immediate termination of the rpd process due to segmentation faults or access violations triggered by the operating system's memory protection mechanisms. The exploit requires no authentication and can be executed remotely over TCP port 179, making it particularly dangerous for internet-facing routers that accept connections from untrusted external peers without strict filtering policies.
The operational impact of this vulnerability is severe, primarily manifesting as a Denial-of-Service condition affecting the affected router's routing capabilities. Since rpd is responsible for maintaining all dynamic routing protocols including BGP, OSPF, and IS-IS within Junos OS, its crash leads to an immediate loss of control plane processing power. Consequently, the router will drop existing BGP sessions with peers that rely on this daemon for session management and tear down established adjacencies. This results in a sudden withdrawal of all routes learned via dynamic protocols, causing network-wide routing blackholes or suboptimal path selection depending on fallback static configurations. For service providers or enterprise networks relying on Juniper infrastructure for core connectivity, such an event can lead to significant downtime, loss of traffic visibility, and potential cascading failures across the network topology until the daemon is manually restarted or the device is rebooted.
Mitigation strategies must focus on both immediate operational controls and long-term remediation steps. The most effective short-term countermeasure involves implementing strict access control lists (ACLs) at the perimeter to restrict BGP peering sessions only to known, trusted IP addresses of legitimate peers. Additionally, network operators should configure filters to drop malformed packets or enforce rate limiting on incoming updates from external peers to reduce the attack surface. It is crucial to verify that all eBGP neighbors are configured with four-octet-AS capability if they use AS numbers greater than 65535, although this vulnerability specifically targets sessions where this negotiation fails or is absent. The definitive resolution requires applying the vendor-provided software patches and updates released by Juniper Networks for the affected versions of Junos OS and Junos OS Evolved. Organizations should prioritize patching in environments exposed to untrusted networks or public internet peering points, as automated scanning tools may actively probe for this specific memory corruption flaw.
This incident aligns with MITRE ATT&CK technique T1498 Network Denial of Service, specifically the variant involving resource exhaustion through protocol abuse. By exploiting a parsing error in a core network infrastructure component, an adversary can disrupt critical communication channels without needing to compromise data confidentiality or integrity directly. The vulnerability underscores the importance of rigorous input validation in routing daemons and highlights the risks associated with legacy BGP configurations that do not enforce modern capability negotiations. Security teams should monitor for unusual spikes in CPU usage on routers running vulnerable versions, which may indicate attempted exploitation attempts before a successful crash occurs. Regular auditing of BGP session parameters and ensuring compliance with RFC 4271 standards regarding AS number handling are essential practices to prevent similar exploits in the future.