CVE-2026-102180
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-121
Impact
A remote attacker with an established BGP peering session can crash the routing daemon (rpd), causing a complete routing denial of service. The attack requires an active BGP RIB streaming telemetry subscription.
Root cause
A stack-based buffer overflow in the routing protocol daemon (rpd) triggers when processing a maliciously crafted BGP route attribute while BGP RIB streaming telemetry is enabled.
Affected systems
Juniper Networks Junos OS from 22.1R1 onward and Junos OS Evolved from 22.1R1-EVO onward (versions prior to these are unaffected; upper bound not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the fixed release listed in vendor advisory JSA112187. If patching immediately is not possible, disable the active BGP RIB streaming telemetry subscription as an interim workaround.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active. This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.