Junos rpd: integer overflow in EVPN route processing crashes the routing daemon and drops fabric adjacencies

CVSS 8.7CVE-2026-101944Firmware, BMC & network fabric+1 more CVEscurated

Impact

Crafted EVPN route updates from an accepted peer overflow an integer in rpd's EVPN route processing, causing a denial of service and disrupting control-plane adjacencies on EVPN-enabled routing instances. Juniper assigned two ids to this integer-overflow defect in EVPN route processing (CVE-2026-101944 and CVE-2026-101945); same component, same class, same advisory and fix, so they are recorded together. For a VXLAN-EVPN GPU fabric, losing rpd on a leaf means the overlay for those GPU nodes goes away until it reconverges, and a peer that can repeat the update can hold it down.

Who can reach it

A remote attacker with an established EVPN BGP peering relationship to the device - on a fabric, a neighbouring leaf, spine or route reflector. No authentication beyond the peering.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187 for the per-platform fixed releases; the upgrade reboots the device. Until then the only lever in the record is control over which devices are allowed to peer EVPN with the box.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2026-101945

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101944 https://supportportal.juniper.net/JSA112187 https://nvd.nist.gov/vuln/detail/CVE-2026-101945

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.