CVE-2026-102024 in Junos OS
Summary
by MITRE • 10/14/2026
An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability resides within the Border Gateway Protocol routing daemon, known as rpd, in both Juniper Networks Junos OS and Junos OS Evolved operating systems. This flaw specifically manifests as an integer overflow or wraparound condition that can be triggered by a maliciously crafted BGP route update message from an authenticated peer. The exploitation of this vulnerability is contingent upon the network device having the extended-nexthop-tunnel feature enabled, which allows for complex tunneling scenarios in routing protocols but introduces additional complexity in packet parsing and memory management logic within the daemon.
From a technical perspective, integer overflow vulnerabilities occur when an arithmetic operation results in a value that exceeds the maximum limit of the data type used to store it. In this context, the rpd process likely fails to properly validate or bound-check numerical values derived from BGP route attributes before performing calculations related to nexthop resolution or tunnel encapsulation parameters. When an authenticated attacker sends specific BGP updates containing manipulated numeric fields, the resulting calculation wraps around to a small positive number or negative value instead of failing safely. This incorrect memory address calculation can lead to out-of-bounds writes, buffer overflows, or critical logic errors that destabilize the routing process. The requirement for authentication means this is not an unauthenticated remote code execution vector but rather requires prior access credentials or session establishment with the BGP peer.
The operational impact of successfully exploiting this vulnerability is primarily a denial of service against the affected device. Because the flaw affects the core routing daemon, triggering it can cause rpd to crash, restart unexpectedly, or become unresponsive. In high-availability environments where Junos OS devices serve as critical routers in an autonomous system, such instability can lead to significant network disruption. Routes may be withdrawn incorrectly, forwarding tables might become inconsistent with control plane decisions, and the device could enter a reboot loop if the daemon fails repeatedly during startup recovery procedures. This results in loss of connectivity for downstream networks relying on BGP peering sessions established with the vulnerable Juniper equipment.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) category CWE-190, which defines Integer Overflow or Wraparound. The attack vector is classified under MITRE ATT&CK technique T1498, specifically Network Denial of Service via exploitation of protocol vulnerabilities that target infrastructure components rather than end-user applications. Mitigation strategies should focus on strict access control for BGP sessions using TCP MD5 authentication and IP-based filtering to ensure only trusted peers can establish peering relationships. Additionally, Juniper Networks has likely released software updates or patches addressing the specific bounds-checking logic in rpd; administrators must apply these updates promptly. Where immediate patching is not feasible, disabling the extended-nexthop-tunnel feature if it is not strictly required for network operations reduces the attack surface by removing the code path susceptible to this integer overflow condition.