CVE-2026-101960: Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-EVO
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected deployments are Junos OS Evolved systems on QFX5240, QFX5241, or QFX5250 that are configured for BGP global load balancing and have more than 128 ECMP next hops.
What does an attacker need to do to trigger the crash?
An attacker needs to act as a BGP peer and cause the vulnerable routing protocol daemon condition. No privileges or user interaction are required according to the supplied vector.
What is the operational impact if exploitation succeeds?
Successful exploitation can crash rpd, the routing protocol daemon. The provided impact information indicates an availability impact only, with no confidentiality or integrity impact stated.