CVE-2026-101957
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-665
Impact
A remote BGP peer can crash the routing protocol daemon (rpd), causing a denial of service across the device. The attacker only needs network access to an established BGP peering session that can send route updates.
Root cause
Improper initialization in rpd fails to handle readvertising LLGR-stale route updates to peer groups configured without LLGR support.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the fixed Junos OS/Junos OS Evolved release specified in advisory JSA112187, or disable LLGR / avoid readvertising LLGR-stale routes to non-LLGR peer groups as a temporary mitigation.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.