CVE-2026-102087: Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects: Junos OS:
All versions before 23.2R2-S6; 23.4 versions before 23.4R2-S7; 24.2 versions before 24.2R2-S4; 24.4 versions before 24.4R2-S4; 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved: All versions before 23.2R2-S6-EVO; 23.4 versions before 23.4R2-S8.11-EVO; 24.2 versions before 24.2R2-S4-EVO; 24.4 versions before 24.4R2-S5-EVO; 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S4-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R1-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-EVO - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S6 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S7 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2-S4 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S4 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R1-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
Affected devices are those running the listed vulnerable Junos OS or Junos OS Evolved releases and participating in a BGP traffic-engineering scenario. Exploitation requires an established BGP session over which the crafted valid optional, non-transitive BGP update can be received.
What level of access does an attacker need?
The attacker does not need authentication or user interaction, but must be adjacent to the target and able to send the relevant update over an established BGP session.
What is the operational impact of exploitation?
The routing protocol daemon crashes and automatically restarts. Traffic can be affected until routing reconverges; the provided data does not indicate confidentiality or integrity impact.
Which releases contain fixes?
For Junos OS, fixed releases include 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, and 25.2R1-S2 or 25.2R2. For Junos OS Evolved, fixed releases include 23.2R2-S6-EVO, 23.4R2-S8.11-EVO, 24.2R2-S4-EVO, 24.4R2-S5-EVO, and 25.2R1-S2-EVO or 25.2R2-EVO.