When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects:
Junos OS:
* All versions before 23.2R2-S6;
* 23.4 versions before 23.4R2-S7;
* 24.2 versions before 24.2R2-S4;
* 24.4 versions before 24.4R2-S4;
* 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
* All versions before 23.2R2-S6-EVO;
* 23.4 versions before 23.4R2-S8.11-EVO;
* 24.2 versions before 24.2R2-S4-EVO;
* 24.4 versions before 24.4R2-S5-EVO;
* 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Juniper Networks | Junos OS | unaffected |
|
||||||||||||||||||
| Juniper Networks | Junos OS Evolved | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
The following software releases have been updated to resolve this specific issue: Junos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R1-S2, 25.2R2, 25.4R1, and all subsequent releases; Junos OS Evolved: 23.2R2-S6-EVO, 23.4R2-S8.11-EVO, 24.2R2-S4-EVO, 24.4R2-S5-EVO, 25.2R1-S2-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases. Note: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.
Vendor Workaround
There are no known workarounds for this issue.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://supportportal.juniper.net/JSA112168 |
|
Wed, 14 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged. This issue affects: Junos OS: * All versions before 23.2R2-S6; * 23.4 versions before 23.4R2-S7; * 24.2 versions before 24.2R2-S4; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R1-S2, 25.2R2; Junos OS Evolved: * All versions before 23.2R2-S6-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S4-EVO; * 24.4 versions before 24.4R2-S5-EVO; * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO; | |
| Title | Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes | |
| Weaknesses | CWE-184 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2026-10-14T16:23:55.281Z
Reserved: 2026-09-28T17:37:38.548Z
Link: CVE-2026-102087
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T17:18:04.800
Modified: 2026-10-14T17:18:04.800
Link: CVE-2026-102087
Redhat
No data.
OpenCVE Enrichment
No data.