CVE-2026-102063 in Junos OS
Summary
by MITRE • 10/14/2026
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the routing protocol daemon, known as rpd, which serves as the core component responsible for managing dynamic routing protocols and maintaining the Routing Information Base on Juniper Networks MX Series routers running Junos OS. This specific flaw manifests as a reachable assertion failure triggered by an unauthenticated network attacker interacting with the Border Gateway Protocol implementation when High-Frequency Route Refresh or HFRR link protection is enabled within a Virtual Routing and Forwarding instance. The presence of this vulnerability indicates a critical deficiency in input validation and state management logic during the processing of external BGP route updates, allowing malicious actors to exploit the system's internal error handling mechanisms rather than traditional buffer overflows or memory corruption techniques.
From a technical perspective, an assertion is a debugging construct used by developers to verify that certain conditions hold true at runtime. In production builds, these assertions are often compiled out or configured to trigger specific failure states if violated. When rpd processes an eBGP route update under the specified configuration of HFRR link protection within a VRF, it encounters a logical state inconsistency that violates its internal assumptions about protocol stability and neighbor relationships. Because this condition is reachable via network traffic from an unauthenticated source, any device capable of sending BGP updates to the vulnerable router can trigger this assertion failure. The immediate operational consequence of triggering such an assertion in a critical system daemon like rpd is typically a process crash or restart. Since rpd manages all dynamic routing protocols on the platform, its termination results in the loss of active neighbor adjacencies and the subsequent withdrawal of learned routes from the forwarding plane.
The impact of this denial-of-service event extends beyond simple service interruption for the affected router itself. As BGP is fundamental to internet backbone connectivity and large enterprise network interconnects, a crash in rpd can lead to significant routing instability across the broader network topology. Neighboring routers will detect the loss of adjacency with the Juniper device and may trigger route flapping or reconvergence events, potentially causing packet loss and increased latency for traffic traversing through that segment. Furthermore, if multiple critical peers are affected simultaneously due to a coordinated attack, it could lead to partial or complete blackholing of traffic destined for networks reachable via the compromised router. This represents a severe availability risk, particularly in environments where high availability is mandated by service level agreements and operational requirements.
This vulnerability aligns with Common Weakness Enumeration category CWE-617, which describes Reachable Assertion failures that can lead to denial of service. It also maps directly to MITRE ATT&CK technique T1498, specifically Network Denial of Service, where an attacker disrupts the availability of a network resource by exploiting protocol implementation flaws rather than overwhelming bandwidth or compute resources. The attack vector is classified as remote and unauthenticated, meaning no prior access credentials are required, significantly lowering the barrier to entry for potential adversaries who can reach the router's management plane or peering interfaces over IP networks.
Mitigation strategies must focus on both immediate operational controls and long-term software remediation. Juniper Networks has likely released a patch in subsequent versions of Junos OS that addresses the logic error within rpd during BGP update processing under HFRR configurations. Administrators should prioritize applying these vendor-supplied updates to all affected MX Series routers as soon as they are available and verified for stability in their specific environment. In cases where immediate patching is not feasible due to maintenance windows or compatibility concerns, network segmentation becomes a critical defensive measure. Restricting eBGP peering sessions to trusted IP addresses using access control lists on the router interfaces can prevent unauthenticated external actors from sending malicious route updates that trigger the assertion failure. Additionally, enabling BGP authentication through MD5 signatures or TCP Authentication Option provides an additional layer of security by ensuring that only peers with shared secrets can establish routing adjacencies and exchange update messages. Monitoring tools should also be configured to detect sudden drops in BGP neighbor states or frequent rpd restarts, which may indicate ongoing exploitation attempts against this vulnerability.