CVE-2026-102030 in Junos OS
Summary
by MITRE • 10/14/2026
An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as CVE-2024-35961 represents a critical resource management flaw within the Route Processor Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved platforms. This specific defect occurs in network environments where Multicast VPN (MVPN) services are configured with inter-region segmentation using Virtual Routing and Forwarding instances, specifically when the protocols mvpn inter-region-template configuration is active. The core technical issue stems from an incomplete cleanup mechanism within the rpd process logic. When a configured MVPN neighbor sends a BGP MVPN update packet under these specific conditions, the system fails to properly release or reset associated internal data structures and memory allocations that were allocated during previous processing cycles. This failure to clean up resources leads to a gradual accumulation of unreleased memory and potentially corrupted state information within the routing engine's operational context.
From an operational perspective, this incomplete cleanup directly results in a denial of service condition for the affected device. As the rpd process continues to handle these malformed or triggering BGP updates without properly freeing its internal resources, it consumes increasing amounts of system memory and CPU cycles dedicated to managing the corrupted state. Eventually, this resource exhaustion causes the routing engine to become unresponsive or crash entirely. Such a failure disrupts all network services dependent on that device, including not only MVPN traffic but also standard IP routing protocols like OSPF, IS-IS, and BGP for non-MVPN routes if they share the same control plane resources. The impact is severe because it allows an authenticated attacker with access to the BGP peering session to destabilize critical network infrastructure without needing elevated privileges beyond what is required for normal neighbor establishment.
This vulnerability aligns closely with CWE-401, which describes a missing release of memory after effective use in dynamic allocation contexts. The exploitation vector involves sending specific BGP UPDATE messages that trigger the flawed cleanup routine within the inter-region MVPN processing logic. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1498.002, Network Denial of Service via Resource Exhaustion by Application Layer Protocol Abuse. The attacker leverages legitimate protocol mechanisms (BGP updates) to induce a state that the system cannot recover from gracefully, leading to service degradation or total outage. This is particularly dangerous in large-scale enterprise and ISP networks where MVPN services are often critical for providing secure, isolated multicast connectivity across different geographic regions or administrative domains.
Mitigation strategies must focus on both immediate remediation and long-term architectural resilience. The primary defense is the application of vendor-provided software patches that address the incomplete cleanup logic within the rpd process. Organizations running Junos OS or Junos OS Evolved should immediately verify their version against the security advisory released by Juniper Networks for CVE-2024-35961 and apply the appropriate update to restore proper resource management behavior. In environments where immediate patching is not feasible due to maintenance windows, network operators can implement access control lists (ACLs) on BGP peerings to restrict which neighbors are allowed to send MVPN updates or inter-region template configurations. This limits the attack surface by preventing untrusted or potentially compromised peers from triggering the vulnerable code path. Additionally, monitoring system logs for signs of rpd restarts or memory usage anomalies can help detect potential exploitation attempts early. Long-term mitigation involves reviewing network design to minimize reliance on complex MVPN inter-region templates where possible and ensuring that critical routing processes are isolated in terms of resource limits through process-level controls if supported by the specific Junos version, thereby containing the impact should a vulnerability be exploited again.