CVE-2026-102025 in Junos OS
Summary
by MITRE • 10/14/2026
A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as a mismatched memory management routine in the routing protocol daemon, known as rpd, within Juniper Networks Junos OS and Junos OS Evolved represents a critical flaw in how system resources are allocated and deallocated during complex network operations. This specific defect occurs when the software attempts to free or release memory blocks that were not originally allocated by the same routine responsible for their liberation. In C-based systems like those underlying many networking operating systems, such mismatches typically involve calling functions like free() on pointers obtained via malloc(), realloc(), or calloc(), or vice versa. When these routines are mismatched, it leads to undefined behavior within the heap manager, often resulting in memory corruption, stack overflow conditions, or immediate process termination. In this specific instance, the flaw is triggered specifically during the processing of Border Gateway Protocol route updates when extended next-hop tunneling and Segment Routing over IPv6 service features are enabled. These advanced routing features involve complex data structures and dynamic memory allocation to handle encapsulation headers and segment lists, increasing the surface area for such low-level programming errors to manifest under specific traffic patterns.
From an operational perspective, this vulnerability allows an authenticated network-based attacker to induce a denial of service against the affected device. The requirement for authentication implies that the attacker must already have valid credentials or access privileges within the routing domain, which may limit the scope but does not diminish the severity given the potential impact on core infrastructure stability. By sending crafted BGP route updates that exploit the mismatched memory management logic, an adversary can cause the rpd process to crash or become unresponsive. Since the routing protocol daemon is central to maintaining network topology and forwarding decisions in Juniper environments, its failure can lead to significant disruption of traffic flow, loss of connectivity for downstream networks relying on BGP peering sessions with the affected device, and potential instability across the broader autonomous system. The impact extends beyond simple service interruption; it may require manual intervention or a full reboot of the routing engine to restore normal operations, thereby increasing downtime and operational costs for network administrators.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-124, which describes Buffer Underwrite, often associated with heap corruption due to improper memory handling routines. It also relates to CWE-789, the general category of Memory Corruption, specifically highlighting issues arising from mismatched allocation and deallocation functions. In terms of offensive security frameworks, this exploit scenario maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an attacker leverages software vulnerabilities to degrade or destroy system availability. The specific vector involves network-based interaction with a privileged service process, emphasizing the importance of strict access controls and input validation in routing daemons that handle dynamic protocol updates from potentially untrusted peers within a configured autonomous system.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided software patches that correct the memory management logic within the rpd component to ensure consistent allocation and deallocation practices. Network administrators should prioritize updating Junos OS and Junos Evolved installations to versions where this flaw has been remediated. In environments where immediate patching is not feasible, implementing strict access control lists on BGP peering sessions can help restrict which peers are allowed to send route updates that trigger the affected code paths. Additionally, enabling enhanced logging for routing protocol events may assist in detecting anomalous traffic patterns indicative of exploitation attempts. Regular audits of network configurations and adherence to least-privilege principles for administrative accounts further reduce the risk surface by limiting the ability of potential attackers to authenticate and interact with the vulnerable daemon processes.