CVE-2026-102087 in Junos OS
Summary
by MITRE • 10/14/2026
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
* All versions before 23.2R2-S6; * 23.4 versions before 23.4R2-S7; * 24.2 versions before 24.2R2-S4; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved: * All versions before 23.2R2-S6-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S4-EVO; * 24.4 versions before 24.4R2-S5-EVO; * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved represents a critical flaw within the Border Gateway Protocol implementation that enables an unauthenticated attacker to trigger a service disruption. This specific weakness, categorized under CWE-754 as Improper Check for Unusual or Exceptional Conditions, stems from an incomplete list of disallowed inputs processed by the routing protocol daemon during BGP traffic engineering operations. The core technical flaw lies in the application's failure to adequately validate optional non-transitive attributes within valid BGP update messages when operating in a traffic engineering context. Because the validation logic does not account for this specific subset of malformed or unexpectedly structured data, the processing engine encounters an unrecoverable error state upon receipt of the crafted packet.
The operational impact of this vulnerability is immediate and severe due to the automatic restart mechanism inherent in the daemon's design. When a neighboring router sends the specific BGP update containing the problematic attribute over an established session, the routing protocol daemon crashes and subsequently reboots itself. This crash results in the temporary loss of routing information held by the affected device. Consequently, network traffic is impacted as the system must undergo reconvergence to restore full connectivity. During this window of instability, packets may be dropped or misrouted until the BGP sessions are fully re-established and the routing table stabilizes with updated path attributes from neighboring peers.
From a threat actor perspective, this vulnerability allows for remote exploitation by any adjacent network node that can establish a BGP session with the target device. The attacker does not require authentication credentials to execute the exploit, significantly lowering the barrier for entry in environments where internal trust relationships are assumed or misconfigured. This aligns with MITRE ATT&CK techniques related to Denial of Service and potentially Resource Injection, as the attacker leverages a specific input vector to exhaust system resources by forcing repeated daemon restarts. The ability to cause such disruption without authentication highlights a significant gap in the boundary defense strategy for routing infrastructure components that handle external or semi-trusted peering relationships.
Mitigation strategies primarily involve applying the vendor-provided software updates listed in the advisory, which patch the input validation logic within the routing protocol daemon. Administrators should prioritize upgrading to versions 23.2R2-S6 and later for Junos OS legacy branches, as well as corresponding stable releases for Junos OS Evolved such as 23.4R2-S8.11-EVO or newer depending on the specific branch in use. In environments where immediate patching is not feasible due to operational constraints, network segmentation strategies should be employed to restrict BGP peering sessions only to trusted and verified neighbors. Additionally, implementing strict prefix filtering and route-map policies can help mitigate some risks by limiting the scope of accepted updates, although this does not fully address the underlying code flaw regarding non-transitive attribute handling. Continuous monitoring for unusual routing table fluctuations or daemon restart logs serves as an effective detection mechanism for potential exploitation attempts in real-time.