CVE-2026-101985 in Junos OS Evolved
Summary
by MITRE • 10/14/2026
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the Intermediate System to Intermediate System (IS-IS) routing protocol implementation, specifically in the routing protocol daemon known as rpd, which is part of Juniper Networks Junos OS Evolved deployed on PTX Series routers. This flaw constitutes an improper validation of specified quantity in input, a critical security misconfiguration that allows external actors to exploit weaknesses in how the system processes incoming network packets. The core technical issue stems from insufficient checks performed by the daemon when handling IS-IS protocol messages received from neighboring devices. Specifically, the software fails to adequately verify the validity or bounds of certain fields within these control plane packets before processing them for routing table updates and adjacency maintenance. This lack of rigorous input sanitization creates a pathway for malicious actors to inject malformed data that triggers unexpected behavior within the application logic.
An unauthenticated attacker positioned as an IS-IS peer can leverage this vulnerability by crafting specific, malformed IS-IS protocol messages designed to exploit these validation gaps. Because the vulnerability affects the control plane processing of routing updates, it does not require prior authentication or established trust relationships with the router. The attacker simply needs network reachability to send crafted packets that contain invalid quantities in specified fields. Upon receipt and attempted parsing by the vulnerable rpd process, these malformed inputs can cause the daemon to enter an unstable state, leading to a crash or hang of the routing protocol service. This results in a denial of service condition where the router loses its ability to maintain IS-IS adjacencies and compute shortest path first trees for network reachability.
The operational impact of this vulnerability is significant due to the central role that IS-IS plays in large-scale enterprise and service provider networks. When the routing protocol daemon becomes unresponsive or crashes, the affected device may cease advertising routes, withdraw existing ones, or fail to process new updates from neighbors. This disruption can lead to network partitioning, black holes for traffic destined through the compromised router, and potential cascading failures if redundant paths are not properly configured or if other routers misinterpret the sudden loss of adjacency as a topology change requiring immediate recalculation. In high-availability environments, while redundancy might mitigate total outage, the increased CPU load from route recalculations can degrade overall network performance and stability.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, where software fails to verify that input data meets expected criteria before processing. It also maps to MITRE ATT&CK techniques related to Disruption via Denial of Service, specifically targeting the control plane infrastructure rather than just application layer services. The attack vector is classified as network-based and remote, requiring no user interaction or local access on the target device. This makes it particularly dangerous in environments where routers are exposed to untrusted networks or where peer relationships might be compromised through spoofing attacks if additional authentication mechanisms like MD5 or TCP-AO are not strictly enforced across all peering sessions.
Mitigation strategies should prioritize immediate patching of Junos OS Evolved to the version that includes fixes for this specific issue, as provided by Juniper Networks in their security advisories. In addition to software updates, network administrators should implement strict access control lists on interfaces running IS-IS to restrict adjacency formation only to known and trusted peer IP addresses. Enabling authentication mechanisms such as MD5 or TCP-AO for all IS-IS neighbor relationships adds a layer of defense that prevents unauthenticated peers from sending any protocol messages, thereby neutralizing the attack vector entirely until patches can be applied. Regular monitoring of routing table stability and daemon health metrics can also help in early detection of potential exploitation attempts or residual instability caused by previous attacks.