Junos rpd: crafted BGP EVPN update message crashes the routing daemon

CVSS 8.7CVE-2026-101943Firmware, BMC & network fabriccurated

Impact

rpd fails to validate input in a crafted BGP EVPN update and crashes, taking the routing daemon down. The record describes the attacker as unauthenticated and network-based, so the exposure is as wide as the set of peers the device accepts EVPN updates from. On an EVPN-VXLAN fabric that carries GPU-to-GPU and GPU-to-storage traffic, an rpd restart is an overlay outage for everything behind that device.

Who can reach it

An unauthenticated network-based attacker able to deliver a crafted BGP EVPN update to the device, which in practice means a configured or hijacked EVPN peering session.

What to do

Upgrade Junos OS / Junos OS Evolved to a release from the Juniper JSA112187 table; the upgrade reboots the device, so each fabric node needs a window. No configuration mitigation is stated in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101943 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.