CVE-2026-101990 in Junos OS
Summary
by MITRE • 10/14/2026
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved represents a critical security flaw within the Border Gateway Protocol implementation. This specific issue stems from a stack-based buffer overflow, a type of memory corruption error that occurs when more data is written to a fixed-length block of memory than it can hold. In this context, the vulnerability resides in how the routing protocol daemon processes flow specification updates received from configured BGP peers. When an attacker sends a specifically crafted flow-spec update designed for re-advertisement, the application fails to properly validate the length or structure of the incoming data before copying it into a stack-allocated buffer. This lack of bounds checking allows maliciously constructed input to overwrite adjacent memory locations on the call stack, corrupting critical control data such as return addresses and saved frame pointers.
From an operational perspective, the impact of this vulnerability is severe due to its remote exploitability without authentication in certain configurations or through compromised peers. If the overflow results only in a crash, it leads to a denial-of-service condition where the routing protocol daemon terminates unexpectedly. This causes immediate disruption to network connectivity and routing stability as the device loses its ability to process BGP updates, potentially leading to blackholing of traffic or loss of reachability for connected networks. However, on versions of Junos OS that are susceptible to code execution via this flaw, an attacker can achieve remote code execution with the privileges of the affected service account. This allows the adversary to take full control of the underlying operating system, install malware, pivot to other internal systems, or exfiltrate sensitive data from the network infrastructure.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-121, which describes stack-based buffer overflow conditions resulting from improper bounds checking during memory operations. The exploitation technique leverages standard ATT&CK tactics related to initial access and execution, specifically mapping to techniques that involve exploiting software vulnerabilities for remote code execution. Attackers typically utilize this flaw by crafting a malicious BGP update packet containing oversized or malformed flow-spec data fields. By targeting the re-advertisement logic, the attacker ensures that the vulnerable code path is triggered during normal routing protocol operations, making detection through standard traffic analysis difficult without deep packet inspection capabilities focused on BGP payload validation.
Mitigation strategies primarily involve applying vendor-provided software patches and updates released by Juniper Networks to address the memory handling deficiencies in the routing protocol daemon. Administrators should ensure that all systems running affected versions of Junos OS or Junos OS Evolved are updated to the latest stable release containing the fix. In environments where immediate patching is not feasible, network segmentation can help mitigate risk by restricting BGP peering relationships to trusted peers only and implementing strict access control lists on router interfaces to prevent unauthorized devices from establishing BGP sessions. Additionally, deploying intrusion prevention systems capable of detecting anomalous BGP traffic patterns or oversized protocol messages may provide a layer of defense against exploitation attempts while permanent remediation is underway.