CVE-2026-101945
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-190
Impact
A remote attacker with an established EVPN BGP peering session can crash the routing protocol daemon (rpd), causing a complete denial of service across routing adjacencies. They need an active, established EVPN BGP peering session with the device to trigger it.
Root cause
An integer overflow occurs in the rpd process when parsing and processing EVPN BGP routes.
Affected systems
Juniper Networks Junos OS and Junos OS Evolved running EVPN-enabled routing instances (exact versions not listed — check vendor advisory JSA112187).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade Junos OS and Junos OS Evolved to the remediated releases listed in Juniper advisory JSA112187. As an interim workaround, tear down or apply route policies to restrict untrusted EVPN BGP peering sessions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.