Database/Firmware, BMC & network fabric
Junos rpd: BGP UPDATE crashes the routing daemon when a policy points at a nonexistent routing table
Impact
An import policy using then source-based-forwarding next-hop next-table <X> that names a routing table which does not exist leaves rpd open to a NULL dereference when a configured peer sends a BGP UPDATE. The precondition is a configuration mistake an operator can make without any warning at commit time, which means the vulnerable state can exist unnoticed on a production device for a long time. The result is a remotely triggered routing-daemon outage.
Who can reach it
A configured BGP peer sending an UPDATE. Requires an import policy referencing a nonexistent routing table.
What to do
Upgrade Junos OS / Junos OS Evolved to a release from Juniper JSA112187; the upgrade reboots the device. There is also a free fix available now: audit import policies for source-based-forwarding next-table actions and correct any that name a table that does not exist.
References
Related entries
- Junos rpd: BGP UPDATE crashes the routing daemon when ISO-VPN and egress protection are configuredCVE-2026-101940 · Juniper Junos OS / Junos OS Evolved rpd (ISO-VPN with egress protection)High
- Junos rpd: BGP route update crashes the routing daemon with resolution-map and policy event-tracing configuredCVE-2026-101941 · Juniper Junos OS / Junos OS Evolved rpd (routing-policy resolution-map with policy event-tracing)High
- Junos rpd: malformed EVPN routes with inconsistent length fields crash the routing daemon on re-advertisementCVE-2026-101942 · Juniper Junos OS / Junos OS Evolved rpd (EVPN NLRI length handling on re-advertisement)High
- Junos rpd: crafted BGP EVPN update message crashes the routing daemonCVE-2026-101943 · Juniper Junos OS / Junos OS Evolved rpd (BGP EVPN update input validation)High
- Junos rpd: integer overflow in EVPN route processing crashes the routing daemon and drops fabric adjacenciesCVE-2026-101944 · Juniper Junos OS / Junos OS Evolved rpd (EVPN BGP route processing, integer arithmetic)High
- Junos rpd: specific BGP FlowSpec update dereferences a NULL pointer and crashes the routing daemonCVE-2026-101948 · Juniper Junos OS / Junos OS Evolved rpd (BGP FlowSpec update handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.