CVE-2026-102022 in Junos OS
Summary
by MITRE • 10/15/2026
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical security flaw within the routing protocol daemon, known as rpd, which is a core component of Juniper Networks' Junos OS and Junos OS Evolved operating systems. This specific issue manifests as a reachable assertion failure triggered by malformed or specially crafted Border Gateway Protocol - Link State (BGP-LS) advertisements. BGP-LS is an extension to the standard BGP protocol designed to distribute link-state information, primarily used in conjunction with Segment Routing and Traffic Engineering applications. The vulnerability arises when the rpd process receives a specific type of Network Layer Reachability Information (NLRI) advertisement that contains structural anomalies or unexpected data patterns within its Link NLRI fields. Instead of gracefully handling this invalid input through proper error checking and exception handling, the software executes an assertion check that fails under these conditions. In many Unix-like operating systems, including those underlying Junos OS, a failed assertion typically results in the immediate termination of the offending process to prevent further corruption or undefined behavior. Consequently, this leads to a crash of the rpd daemon, which is responsible for maintaining routing tables and managing dynamic routing protocols across the network infrastructure.
From an operational perspective, the impact of this vulnerability is severe due to its potential to cause service disruption through denial-of-service conditions. Since BGP-LS peers are typically configured between routers within an autonomous system or between adjacent administrative domains, any entity with the ability to establish a peering session and send crafted packets can exploit this flaw. The immediate consequence of triggering the assertion failure is the restart of the rpd process. While Junos OS often includes mechanisms for automatic daemon recovery, the transient downtime during the crash and subsequent reload can lead to routing table instability, loss of connectivity, or temporary blackholing of traffic depending on the convergence time of adjacent protocols such as OSPF IS-IS or standard BGP. In environments relying heavily on Segment Routing and advanced traffic engineering features that depend on continuous availability of link-state information, this disruption could degrade network performance significantly or cause complete service outages if multiple peers are targeted simultaneously or if the crash occurs during critical routing updates.
This vulnerability is technically classified under Common Weakness Enumeration (CWE) standards as CWE-617: Reachable Assertion. An assertion failure indicates that a program has encountered an internal state that it considers impossible, often due to insufficient validation of external inputs before processing them. The root cause lies in the lack of rigorous boundary checking and data sanitization within the BGP-LS parsing logic of the rpd daemon. When constructing or receiving NLRI advertisements, the software assumes certain structural integrity regarding length fields, type codes, or attribute values without verifying that these elements conform to expected ranges or formats defined by RFC standards such as RFC 7752 for BGP-LS. By sending a crafted packet with malformed attributes, an attacker forces the parser into an invalid state where subsequent logic triggers the assertion failure. This aligns closely with CWE-20: Improper Input Validation, highlighting that the system failed to adequately validate data received from external sources before processing it within critical security boundaries.
In terms of threat modeling and adversary behavior, this vulnerability maps directly to techniques observed in real-world attacks as defined by the MITRE ATT&CK framework. Specifically, it corresponds to T1498: Network Denial of Service, where an attacker aims to disrupt service availability rather than compromise confidentiality or integrity. The exploitation vector is classified as Remote with Low Complexity if the attacker has access to a configured BGP-LS peer session, which implies they must already have some level of network reachability and potentially authentication credentials for that specific peering relationship. However, in scenarios where MD5 authentication or other strong controls are not implemented on the BGP sessions, this could escalate to Remote with High Privileges if combined with other vulnerabilities allowing unauthorized access. The attack requires no user interaction but does require active engagement with the network infrastructure by sending malicious packets directly to the targeted router interface configured for BGP-LS peering.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Juniper Networks has released software updates that patch this assertion failure, ensuring proper input validation is performed before processing NLRI advertisements. Administrators should immediately apply these vendor-provided patches to all affected systems running vulnerable versions of Junos OS or Junos OS Evolved. In addition to applying fixes, network operators should review their BGP peering configurations and enforce strict access controls. This includes implementing MD5 authentication for all BGP sessions where feasible, restricting peer relationships using prefix lists and route filters to ensure only expected NLRI types are accepted, and deploying inbound filtering rules on border routers to drop malformed packets before they reach the routing engine. Furthermore, monitoring tools should be configured to detect unusual patterns in BGP traffic or frequent rpd restarts, which could indicate an ongoing exploitation attempt. Regular audits of peering agreements and continuous updates based on vendor security advisories remain essential components of a robust defense-in-depth strategy against such protocol-level vulnerabilities.