Database/Firmware, BMC & network fabric
Junos rpd: BGP route update crashes the routing daemon with resolution-map and policy event-tracing configured
Impact
With a specific routing-policy resolution-map and policy event-tracing enabled, a BGP route update from a configured neighbour dereferences a NULL pointer in rpd and causes a denial of service. Policy event-tracing is a debugging aid, so the risky state is one an operator typically enters deliberately while troubleshooting - and then forgets to leave. A crash during a troubleshooting session on a fabric device compounds whatever problem prompted the tracing.
Who can reach it
A configured BGP neighbour sending a route update. Requires the resolution-map plus policy event-tracing configuration.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. In the meantime, turn off policy event-tracing when it is not actively needed - that removes the trigger with a commit rather than a maintenance window.
References
Related entries
- Junos rpd: malformed EVPN routes with inconsistent length fields crash the routing daemon on re-advertisementCVE-2026-101942 · Juniper Junos OS / Junos OS Evolved rpd (EVPN NLRI length handling on re-advertisement)High
- Junos rpd: crafted BGP EVPN update message crashes the routing daemonCVE-2026-101943 · Juniper Junos OS / Junos OS Evolved rpd (BGP EVPN update input validation)High
- Junos rpd: integer overflow in EVPN route processing crashes the routing daemon and drops fabric adjacenciesCVE-2026-101944 · Juniper Junos OS / Junos OS Evolved rpd (EVPN BGP route processing, integer arithmetic)High
- Junos rpd: specific BGP FlowSpec update dereferences a NULL pointer and crashes the routing daemonCVE-2026-101948 · Juniper Junos OS / Junos OS Evolved rpd (BGP FlowSpec update handling)High
- Junos rpd: VPN-flowspec update crashes the routing daemon when BMP post-policy RIB-out monitoring is onCVE-2026-101949 · Juniper Junos OS / Junos OS Evolved rpd (VPN-flowspec re-advertisement with BMP post-policy RIB-out)High
- Junos rpd: malformed BGP MCAST-TREE update crashes the routing daemon on re-advertisementCVE-2026-101951 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-TREE NLRI re-advertisement)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.