Database/Firmware, BMC & network fabric
Junos rpd: malformed EVPN routes with inconsistent length fields crash the routing daemon on re-advertisement
Impact
rpd mishandles length-parameter inconsistency in EVPN routes received from a configured peer and processed during re-advertisement, crashing the routing daemon. Juniper assigned two ids to this EVPN NLRI length-handling defect (CVE-2026-101942 for Type-3/Type-4 routes and CVE-2026-101962 for EVPN multicast updates); same subsystem, same class, same fix, so they are recorded together. The crash propagates: a device that re-advertises EVPN routes is usually a spine or route reflector, and when its rpd restarts the overlay for the GPU racks beneath it reconverges.
Who can reach it
A configured EVPN BGP peer, or anything that can establish or hijack that session on the fabric. No authentication beyond the peering. Requires the device to re-advertise the affected EVPN routes.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device, so plan a window per fabric node. No configuration mitigation is given in the record beyond limiting which peers can send EVPN routes.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- Junos rpd: crafted BGP EVPN update message crashes the routing daemonCVE-2026-101943 · Juniper Junos OS / Junos OS Evolved rpd (BGP EVPN update input validation)High
- Junos rpd: integer overflow in EVPN route processing crashes the routing daemon and drops fabric adjacenciesCVE-2026-101944 · Juniper Junos OS / Junos OS Evolved rpd (EVPN BGP route processing, integer arithmetic)High
- Junos rpd: specific BGP FlowSpec update dereferences a NULL pointer and crashes the routing daemonCVE-2026-101948 · Juniper Junos OS / Junos OS Evolved rpd (BGP FlowSpec update handling)High
- Junos rpd: VPN-flowspec update crashes the routing daemon when BMP post-policy RIB-out monitoring is onCVE-2026-101949 · Juniper Junos OS / Junos OS Evolved rpd (VPN-flowspec re-advertisement with BMP post-policy RIB-out)High
- Junos rpd: malformed BGP MCAST-TREE update crashes the routing daemon on re-advertisementCVE-2026-101951 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-TREE NLRI re-advertisement)High
- Junos rpd: ISO-VPN update processed by BMP route monitoring or NSR crashes the routing daemonCVE-2026-101952 · Juniper Junos OS / Junos OS Evolved rpd (ISO-VPN route export to BMP / NSR)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.