CVE-2026-102065: Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled

Published Oct 14, 2026

Updated

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.

Affected Software

2 affected components

Juniper Networks Junos OS

Juniper Networks Junos OS Evolved

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.6-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 24.4R2-S5-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2R2-S2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.2X100-D35-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R1-S3-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4R2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 25.4X300-D40-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R1-S2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.2R2-EVO
Upgrade
Upgrade Juniper Junos OS Evolved to a version that resolves this vulnerability.
Fixed in 26.4R1-EVO
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.2R2-S5.5
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 24.4R2-S5
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.2R2-S2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R1-S3
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 25.4R2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R1-S2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.2R2
Upgrade
Upgrade Juniper Junos OS to a version that resolves this vulnerability.
Fixed in 26.4R1

Event History

Oct 14, 2026

CVE Published

via MITRE·04:20 PM

Data Sourced

via MITRE·04:20 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Junos OS and Junos OS Evolved deployments are exposed when SRv6 dynamic tunnels are enabled and the device accepts BGP sessions from peers that can send BGP-signaled SRv6 service routes.

What does an attacker need to exploit the vulnerability?

An attacker must be able to act as a remote, unauthenticated BGP peer and send a malformed BGP-signaled SRv6 service route. No user interaction or prior privileges are required.

What is the expected impact of successful exploitation?

Successful exploitation can crash the routing protocol daemon (rpd), causing a denial-of-service condition. The provided data indicates no confidentiality or integrity impact.