CVE-2026-102067 in Junos OS
Summary
by MITRE • 10/15/2026
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical flaw within the Routing Protocol Daemon, known as rpd, which serves as the core component for managing dynamic routing protocols in Juniper Networks operating systems including both Junos OS and Junos OS Evolved. This specific weakness stems from an improper validation of specified quantities found within input data processed by the daemon. The security impact is particularly severe because it allows an adjacent unauthenticated attacker to trigger a denial of service condition without requiring any form of authentication or prior access privileges. This characteristic significantly lowers the barrier for exploitation, enabling threat actors who have network connectivity to the affected device to disrupt services with relative ease.
The technical mechanism behind this vulnerability centers on the handling of Resource Reservation Protocol packets when Layer 2 Label Switched Path support is enabled within the system configuration. RSVP is a signaling protocol used to reserve resources in an IP network for real-time and other traffic flows that require special quality of service treatment. When L2 LSP functionality is active, the rpd daemon processes specific RSVP messages to establish and maintain these paths. The flaw arises because the software fails to adequately validate the quantity or length parameters contained within certain crafted RSVP packets. An attacker can construct a malicious packet with malformed or excessively large quantity fields that exceed expected bounds or logical limits defined by the protocol specification. Upon receiving this crafted input, the daemon does not properly check for integer overflows, buffer boundaries, or logical consistency before proceeding with further processing operations.
This lack of rigorous validation leads to unstable internal states within the routing process. Depending on the specific implementation details and memory management routines involved, such malformed inputs can cause the rpd process to crash, hang, or enter an unrecoverable error state. Since the Routing Protocol Daemon is responsible for maintaining critical routing tables and adjacency information with neighboring routers, its failure results in a significant disruption of network connectivity. Devices relying on dynamic routing protocols may lose reachability to remote networks, leading to service outages that can affect entire segments of an enterprise or carrier-grade infrastructure. The impact is not limited to the local device but extends to all peers attempting to communicate through it during the period of instability.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-190 Integer Overflow or Wraparound if the quantity field leads to memory corruption issues. In terms of offensive security frameworks, this exploit scenario maps directly to MITRE ATT&CK technique T1498 Network Denial of Service, specifically under sub-techniques involving resource exhaustion through protocol abuse. The attack vector is classified as adjacent network access with no authentication requirements, which places it in a high-risk category for environments where devices are exposed to untrusted or semi-trusted networks such as DMZs or peering points.
Mitigation strategies must focus on both immediate remediation and long-term architectural defenses. Juniper Networks has released software updates that address this specific validation logic within the rpd component, ensuring that RSVP packet quantities are strictly checked against acceptable limits before processing. Administrators should prioritize applying these patches to all affected systems as soon as possible. In environments where patching cannot be implemented immediately due to operational constraints, network segmentation and access control lists can provide a temporary layer of defense by restricting UDP port 4968 traffic from untrusted sources. Additionally, enabling RSVP message authentication using MD5 or SHA-HMAC can prevent unauthorized devices from sending crafted packets that trigger the vulnerability. Regular monitoring for unusual routing protocol activity and implementing rate limiting on RSVP messages can further reduce the risk of successful exploitation while maintaining network stability.