CVE-2026-101942
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-130
Impact
A network-adjacent or peered attacker can crash the routing protocol daemon (rpd), causing a denial of service across the device. They need the ability to send a malformed EVPN Type-3 or Type-4 route from an established EVPN peer during re-advertisement.
Root cause
The routing protocol daemon (rpd) fails to handle length parameter inconsistencies when processing and re-advertising malformed EVPN Type-3 or Type-4 routes.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the fixed Junos OS and Junos OS Evolved releases specified in Juniper advisory JSA112187; if upgrading immediately is not possible, restrict EVPN BGP peering sessions only to trusted networks and devices.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.