CVE-2026-101990
9.8CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
A remote configured BGP peer can execute arbitrary code on Junos OS or crash the routing daemon (rpd) on Junos OS Evolved. The attacker needs an established BGP session with your device and must send a crafted flow-spec route that the router re-advertises.
Root cause
A stack-based buffer overflow in rpd occurs when processing a BGP flow-spec update selected for re-advertisement.
Affected systems
Juniper Networks Junos OS and Junos OS Evolved; specific version numbers are not listed in the advisory summary — check vendor advisory JSA112187.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the patched Junos OS/Junos OS Evolved release specified in advisory JSA112187. As an interim workaround, disable flow-spec route re-advertisement or remove the BGP flow-spec address family from untrusted peers.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.