CVE-2026-102185 in Junos OS
Summary
by MITRE • 10/14/2026
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the Routing Protocol Daemon, commonly referred to as rpd, which is a core component responsible for managing routing protocols and path selection in Juniper Networks operating systems including both Junos OS and Junos OS Evolved. This specific flaw manifests as an infinite loop or a loop with an unreachable exit condition during the processing of Ethernet Virtual Private Network multihoming scenarios that utilize preference-based designated-forwarder election mechanisms. The vulnerability is triggered by remote network attackers who can craft specific BGP update messages related to EVPN routes, exploiting logic errors in how the daemon evaluates and processes these updates under certain multihoming configurations.
From a technical perspective, the root cause lies in the algorithmic handling of preference values during the designated-forwarder election process within an Ethernet Segment. When multiple Provider Edge routers are connected to the same Ethernet Segment, they must elect one router as the Designated Forwarder to handle traffic for that segment. The protocol relies on comparing preferences and other attributes to determine this leader. In vulnerable versions of Junos OS, a specific sequence or combination of BGP updates can cause the rpd process to enter an infinite loop while attempting to resolve the designated forwarder status. This occurs because the internal state machine fails to reach a terminal condition due to flawed logic in handling edge cases involving preference-based elections, leading to continuous CPU consumption without progress toward a stable routing state.
The operational impact of this vulnerability is severe and primarily centers on service disruption through denial of service conditions. Because the flaw causes an infinite loop within a critical system daemon, it leads to excessive CPU utilization that can eventually cause the rpd process to hang or crash entirely. Since rpd manages core routing functions, its failure results in the loss of dynamic routing adjacencies and potential blackholing of traffic for affected prefixes. This effectively denies network services to legitimate users relying on those routes. The attack is particularly dangerous because it requires only remote network access, meaning an attacker does not need physical proximity or local system access but merely needs to be able to send BGP packets to the vulnerable router within the same autonomous system or peering relationship.
This vulnerability aligns with CWE-835, which describes loops that never terminate due to unreachable exit conditions, and falls under the broader category of logic errors in network protocol implementations. In terms of offensive security frameworks such as MITRE ATT&CK, this exploitation technique relates to resource exhaustion attacks where an adversary aims to degrade or halt system availability by consuming computational resources indefinitely. It is categorized within techniques that target infrastructure services rather than user data confidentiality, emphasizing the critical nature of maintaining routing stability in enterprise and service provider networks.
Mitigation strategies primarily involve applying vendor-supplied software updates that patch the logic error within the rpd component responsible for EVPN multihoming processing. Administrators should ensure their Juniper Networks devices are running a version of Junos OS or Junos OS Evolved where this specific flaw has been addressed by engineering teams. In environments where immediate patching is not feasible, network segmentation and strict access control lists can be employed to restrict BGP peering sessions only to trusted peers, thereby reducing the attack surface available to potential remote attackers attempting to trigger the infinite loop condition through maliciously crafted route advertisements.