CVE-2026-102179 in Junos OS
Summary
by MITRE • 10/15/2026
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as an out-of-bounds write in the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon, known as rpd, represents a critical memory safety flaw within the Border Gateway Protocol (BGP) implementation, specifically affecting Ethernet Virtual Private Network (EVPN) route processing. This defect is triggered under specific operational conditions where the l2vpn-evpn Route Information Base (RIB) telemetry sensor is actively subscribed by monitoring tools or internal processes. The core technical issue stems from improper bounds checking during the handling of BGP EVPN update messages, allowing an attacker who has established a configured BGP session with the affected device to write data beyond the allocated memory buffers associated with route processing structures. This type of vulnerability falls squarely under CWE-787: Out-of-bounds Write in standard classification systems, indicating that the software fails to verify whether written data fits within its intended buffer boundaries before performing the operation.
The operational impact of this flaw is severe and directly impacts network availability and stability. When an attacker successfully exploits this condition by sending crafted BGP EVPN route advertisements or updates while the telemetry sensor is active, it causes a segmentation fault that leads to the immediate crash of the rpd process. Since rpd is responsible for managing dynamic routing protocols including OSPF, IS-IS, and BGP itself, its termination results in an abrupt interruption of all routing protocol adjacencies maintained by the daemon. The network experiences a loss of reachability information as routes are withdrawn or become unreachable until the system automatically restarts the rpd process and initiates route reconvergence. This period of instability can lead to significant packet loss, increased latency, and potential blackholing of traffic depending on the speed at which neighboring routers detect the adjacency failure and update their forwarding tables.
From a threat actor perspective, this vulnerability aligns with MITRE ATT&CK technique T1498: Network Denial of Service, specifically under the sub-technique of resource exhaustion or service disruption through protocol manipulation. The requirement for an attacker to have access to a configured BGP EVPN peer implies that exploitation is generally limited to authenticated users or those who can inject traffic into established sessions, such as via session hijacking if authentication mechanisms are weak or compromised. However, in many enterprise and ISP environments where BGP peers are trusted based on IP address whitelisting rather than strong cryptographic authentication like MD5 or TCP-AO, the attack surface is significantly expanded. The presence of the l2vpn-evpn RIB telemetry sensor acts as a specific trigger condition, meaning that disabling this feature when not strictly necessary for operational monitoring can serve as an effective immediate mitigation strategy to reduce exposure.
To mitigate this risk, administrators should ensure that all Juniper Networks devices running affected versions of Junos OS and Junos OS Evolved are updated to the latest stable release containing the vendor-provided patch. If updating is not immediately feasible, disabling the l2vpn-evpn RIB telemetry sensor on interfaces where BGP EVPN peers are configured can prevent the specific code path from being executed during route processing. Additionally, implementing strict access control lists (ACLs) and using TCP Authentication Option (TCP-AO) for BGP sessions ensures that only authorized peers can establish connections capable of triggering this vulnerability. Regular monitoring of system logs for rpd restart events should also be maintained to detect potential exploitation attempts or crashes resulting from other causes, allowing for rapid incident response and restoration of routing stability.