CVE-2026-102024
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-190
Impact
An authenticated BGP peer can crash the routing daemon (rpd) and cause a denial of service by sending malicious BGP route updates. The peer needs an established BGP session with the router where extended-nexthop-tunnel is configured.
Root cause
An integer overflow in the rpd daemon occurs when handling specific BGP route updates with extended-nexthop-tunnel enabled.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the patched Junos OS / Junos OS Evolved release specified in Juniper advisory JSA112187, or temporarily disable extended-nexthop-tunnel on affected BGP groups/neighbors as an interim mitigation.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.