CVE-2026-102043 in Junos OS
Summary
by MITRE • 10/14/2026
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical flaw within the Resource Reservation Protocol (RSVP) Traffic Engineering implementation, specifically affecting the rpd daemon in both Juniper Networks Junos OS and Junos OS Evolved platforms. This Numeric Truncation Error occurs during the processing of MPLS-TE fast-reroute signaling messages sent by an adjacent network attacker. The core technical issue stems from improper validation or handling of numeric values within the protocol message structures, leading to a situation where larger integer values are incorrectly truncated into smaller data types without appropriate bounds checking or overflow protection mechanisms in place.
When an attacker crafts and transmits specially designed MPLS-TE signaling packets containing manipulated numerical fields, the rpd process interprets these truncated values incorrectly during its internal calculations for fast-reroute path computation or resource reservation updates. This misinterpretation disrupts the normal execution flow of the routing protocol daemon, causing it to encounter an unrecoverable error condition that triggers a segmentation fault or similar memory corruption event. Consequently, this results in the immediate crash and restart of the rpd process, which is responsible for maintaining critical routing table information and forwarding decisions on the device.
The operational impact of this vulnerability is severe due to its potential to cause a denial-of-service against the network infrastructure. Since the rpd daemon manages dynamic routing protocols such as OSPF, IS-IS, BGP, and MPLS-TE itself, its crash leads to an immediate loss of routing adjacency with neighboring routers. This disruption causes traffic blackholing for any flows dependent on the affected routes until the process restarts and reconverges. In high-availability environments or during active network changes, this transient outage can lead to significant service degradation, packet loss, and potential instability in the broader network topology as other devices react to the sudden disappearance of routing peers.
From a threat modeling perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, specifically manifesting through truncation errors that bypass expected value ranges. It also maps directly to MITRE ATT&CK technique T1498 Network Denial of Service, as the primary objective and effect is to disrupt network availability by exhausting or crashing a critical system component via malformed input rather than resource consumption in the traditional sense. The requirement for an adjacent attacker indicates that exploitation requires Layer 2 connectivity or direct IP reachability without intermediate security controls like firewalls filtering RSVP traffic, which limits the attack surface but does not eliminate the risk within trusted internal networks or data center fabrics.
Mitigation strategies should prioritize applying vendor-supplied software patches as soon as they become available to address the underlying code defect in the rpd process. In environments where immediate patching is not feasible, network administrators can implement access control lists on router interfaces to restrict RSVP and MPLS-TE signaling traffic to only known, trusted neighbor IP addresses. Additionally, enabling RSVP authentication mechanisms such as MD5 or SHA-HMAC can help prevent unauthorized devices from injecting malicious signaling messages into the routing process. Regular monitoring of system logs for rpd restarts and implementing strict ingress filtering on edge routers further reduces the likelihood of successful exploitation by limiting exposure to untrusted network segments.