CVE-2026-102180 in Junos OS
Summary
by MITRE • 10/14/2026
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.
This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical stack-based buffer overflow within the routing protocol daemon, commonly referred to as rpd, which serves as the core component for managing dynamic routing protocols in Juniper Networks operating systems including both Junos OS and Junos OS Evolved. This specific flaw is triggered under precise operational conditions where an attacker who has established a Border Gateway Protocol peering session with the vulnerable device can exploit the interaction between route processing and telemetry features. The vulnerability manifests when the system processes a specifically crafted BGP route attribute while a BGP RIB streaming telemetry subscription remains active on the target router. This combination of states creates a window where memory management errors occur, allowing for unauthorized control over program execution flow or causing immediate service disruption through application crash.
From a technical perspective, stack-based buffer overflows typically arise when data is copied into a fixed-size buffer allocated on the call stack without adequate bounds checking. In this scenario, the crafted BGP route attribute likely contains payload data that exceeds the expected size limits defined by the rpd process for handling telemetry-related structures or internal buffers associated with RIB updates. Because the overflow occurs on the stack, it can corrupt adjacent memory locations including return addresses and saved frame pointers. While the primary reported impact is a denial of service resulting from the termination of the routing daemon, such vulnerabilities inherently carry the risk of arbitrary code execution if an attacker successfully overwrites control data to redirect instruction pointer flow. The requirement for an active BGP RIB streaming telemetry subscription suggests that specific memory allocation patterns or context switching mechanisms within the telemetry subsystem are involved in triggering this boundary condition error during route attribute parsing.
The operational impact of this vulnerability is significant due to its potential to disrupt network stability and availability. A successful exploitation leads to a denial of service by causing the routing protocol daemon to crash, which can result in the loss of routing information and temporary connectivity issues for networks relying on BGP peering with the affected device. This disruption affects high-availability environments where continuous route calculation is essential for traffic engineering and failover mechanisms. The vulnerability specifically targets configurations that utilize streaming telemetry for monitoring network state, a feature increasingly common in modern SDN and automated network management architectures. Consequently, organizations deploying these features on Juniper platforms are at elevated risk compared to those with telemetry disabled or not configured for BGP RIB streams.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is the application of vendor-provided software updates that patch the buffer overflow within the rpd component, specifically targeting Junos OS versions 22.1R1 and later as well as Junos OS Evolved versions 22.1R1-EVO and later for affected platforms. In environments where immediate patching is not feasible due to operational constraints or testing requirements, network segmentation should be employed to restrict BGP peering sessions from untrusted networks. Additionally, administrators can mitigate the risk by disabling BGP RIB streaming telemetry subscriptions if they are not strictly required for monitoring purposes, thereby removing the specific trigger condition that leads to the vulnerability being exploited. Regular auditing of BGP peer configurations and strict validation of incoming route attributes through upstream filtering or prefix lists further reduces the attack surface.
This incident aligns with CWE-121, which classifies stack-based buffer overflow vulnerabilities resulting from insufficient bounds checking during memory operations. From a threat intelligence perspective, the exploitation vector corresponds to ATT&CK technique T1498 Network Denial of Service, as the primary outcome is service disruption rather than data exfiltration or system compromise at this stage. However, given the nature of stack overflows, security teams should remain vigilant for indicators of more advanced exploitation attempts that may leverage similar memory corruption flaws for privilege escalation or remote code execution in future updates or related components within the Juniper ecosystem. Continuous monitoring of routing daemon logs and telemetry streams can aid in detecting anomalous behavior indicative of attempted exploitation before a crash occurs.