Database/Firmware, BMC & network fabric
Junos rpd: BGP UPDATE crashes the routing daemon when ISO-VPN and egress protection are configured
Impact
With ISO-VPN and egress-protection configuration enabled, a BGP UPDATE from a configured peer dereferences a NULL pointer in rpd and crashes the routing daemon. The exposure is narrow - it needs that specific pair of features - but where it applies the crash is remotely repeatable by an unauthenticated peer, which turns it into a sustained control-plane outage rather than a one-off restart.
Who can reach it
An unauthenticated configured BGP peer. Requires ISO-VPN plus egress-protection configuration on the device.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. If ISO-VPN egress protection is not needed, removing that configuration removes the trigger without a reboot.
References
Related entries
- Junos rpd: BGP route update crashes the routing daemon with resolution-map and policy event-tracing configuredCVE-2026-101941 · Juniper Junos OS / Junos OS Evolved rpd (routing-policy resolution-map with policy event-tracing)High
- Junos rpd: malformed EVPN routes with inconsistent length fields crash the routing daemon on re-advertisementCVE-2026-101942 · Juniper Junos OS / Junos OS Evolved rpd (EVPN NLRI length handling on re-advertisement)High
- Junos rpd: crafted BGP EVPN update message crashes the routing daemonCVE-2026-101943 · Juniper Junos OS / Junos OS Evolved rpd (BGP EVPN update input validation)High
- Junos rpd: integer overflow in EVPN route processing crashes the routing daemon and drops fabric adjacenciesCVE-2026-101944 · Juniper Junos OS / Junos OS Evolved rpd (EVPN BGP route processing, integer arithmetic)High
- Junos rpd: specific BGP FlowSpec update dereferences a NULL pointer and crashes the routing daemonCVE-2026-101948 · Juniper Junos OS / Junos OS Evolved rpd (BGP FlowSpec update handling)High
- Junos rpd: VPN-flowspec update crashes the routing daemon when BMP post-policy RIB-out monitoring is onCVE-2026-101949 · Juniper Junos OS / Junos OS Evolved rpd (VPN-flowspec re-advertisement with BMP post-policy RIB-out)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.