CVE-2026-102044 in Junos OS
Summary
by MITRE • 10/14/2026
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the Route Policy Daemon, commonly referred to as rpd, which is a critical component of the Juniper Networks Junos Operating System and Junos OS Evolved platforms responsible for handling routing protocols including Border Gateway Protocol Link State (BGP-LS). This specific flaw manifests as a reachable assertion error triggered by the processing of malformed or specifically crafted BGP-LS update messages received from an authenticated peer. An attacker who has established a valid BGP session with the vulnerable device can exploit this condition to force the rpd process into a state where it fails its internal consistency checks, resulting in a crash and subsequent restart of the routing daemon. This behavior directly leads to a denial of service condition for network services that rely on dynamic route calculation and distribution via BGP-LS, potentially causing significant disruption to traffic engineering and segment routing operations within the affected infrastructure.
From a technical perspective, reachable assertions indicate that the software contains defensive programming checks designed to catch logical errors or unexpected states during execution. While these assertions are intended to prevent undefined behavior in production code by halting execution when an invariant is violated, their presence here suggests insufficient input validation or state management logic within the BGP-LS message parser. When a peer sends updates that violate expected protocol constraints or internal data structure assumptions, the assertion triggers rather than gracefully handling the error. This results in the termination of the rpd process, which forces the device to reload its routing table and re-establish adjacencies with all peers. The impact is particularly severe because BGP-LS is often used for complex network automation and telemetry applications where continuous availability of route information is paramount.
The operational impact of this vulnerability extends beyond a simple service restart. During the period when rpd is down, the device cannot process new routing updates or advertise changes to its peers. This can lead to temporary blackholing of traffic that depends on routes learned via BGP-LS, such as those used for Segment Routing Label Switched Paths (SR-LSPs). Furthermore, the frequent crashing and restarting of critical daemons due to repeated exploitation attempts can cause high CPU utilization and memory churn, potentially degrading overall device performance even if full connectivity is not immediately lost. Network operators may also experience instability in their orchestration systems that rely on real-time BGP-LS data for topology discovery and path computation.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-617, which describes Reachable Assertion, indicating a failure to properly handle error conditions or invalid inputs before they trigger internal program checks. In the context of the MITRE ATT&CK framework, this exploitation technique falls under Tactic TA0004 Impact and specifically Technique T1499 Endpoint Denial of Service, as it aims to degrade or halt the availability of a critical network service component. It may also be categorized under T1529 System Shutdown or Reboot if the crash leads to an automatic system restart depending on the specific configuration and severity of the daemon failure.
Mitigation strategies primarily involve applying vendor-provided software patches that address the input validation logic within the rpd process for BGP-LS updates. Administrators should ensure their Junos OS installations are updated to versions where this assertion has been removed or replaced with proper error handling routines. In environments where immediate patching is not feasible, network segmentation and access control lists can be employed to restrict BGP peering sessions from untrusted sources. Additionally, configuring BGP timers to detect and drop suspiciously rapid connection attempts may help mitigate the frequency of exploitation attempts, although this does not eliminate the risk posed by a single crafted packet from an authorized peer who has already established trust through authentication mechanisms like MD5 or TCP-AO.