CVE-2026-101963
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-682
Impact
A remote BGP EVPN peer can crash the routing protocol daemon (rpd), causing a denial of service. The attacker needs an established BGP peering session to a device with SRv6 EVPN multihoming enabled.
Root cause
An incorrect calculation flaw inside rpd triggers a daemon crash when processing traffic under an SRv6 EVPN multihoming configuration.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the fixed Junos OS and Junos OS Evolved releases specified in advisory JSA112187. If you cannot patch immediately, disable SRv6 EVPN multihoming or tear down peering with untrusted BGP EVPN neighbors.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.