CVE-2026-102066: Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.4R1-EVO - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
Who can exploit this issue?
An adjacent attacker does not need authentication, but must be able to send a malformed RSVP packet to an affected receiving interface. The issue applies only where RSVP is enabled on that interface.
What is the impact of a successful attack?
A successful attack can crash the routing protocol daemon (rpd), resulting in a denial of service. The provided information does not indicate confidentiality or integrity impact.
Are systems affected if RSVP is not enabled?
The vulnerability is described as requiring RSVP to be enabled on the receiving interface. Systems or interfaces without RSVP enabled are not identified as exposed by the provided information.
What can be done if patching is not immediately possible?
Disable RSVP on receiving interfaces where it is not required to remove the stated attack condition. Restricting adjacent network access to those interfaces may also reduce exposure, since the attacker must be adjacent.