CVE-2026-101962: Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used

Published Oct 14, 2026

Updated

An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.11-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2X100-D35-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4X300-D40-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R1-S2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2-EVO
Upgrade
Upgrade Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1-EVO
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 23.2R2-S7.7
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 23.4R2-S8.13
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·05:19 PM

Data Sourced

via MITRE·05:19 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Junos OS and Junos OS Evolved deployments that use BGP EVPN signaling are exposed when they can receive a malformed BGP EVPN multicast update that is attempted to be readvertised.

What must an attacker do to trigger the crash?

The attacker must send a specifically malformed BGP EVPN multicast update. The update must reach the routing protocol daemon and be attempted for readvertisement.

What is the operational impact of successful exploitation?

Successful exploitation crashes the routing protocol daemon (rpd), resulting in a denial-of-service condition. The provided data does not indicate confidentiality or integrity impact.