Database/Firmware, BMC & network fabric
Junos rpd: specific BGP FlowSpec update dereferences a NULL pointer and crashes the routing daemon
Impact
A specific BGP FlowSpec update received on an affected session dereferences a NULL pointer in rpd and takes the routing daemon down. The attacker is described as a remote unauthenticated BGP peer, so any neighbour the device accepts FlowSpec from can do it, repeatedly. FlowSpec is often enabled on the border devices that protect a cluster from volumetric traffic, which makes the control plane that enforces that protection the thing that falls over.
Who can reach it
A remote unauthenticated BGP peer on a session where the device accepts FlowSpec routes.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. If FlowSpec is not in use on a session, removing that address family removes the trigger without a reboot.
References
Related entries
- Junos rpd: VPN-flowspec update crashes the routing daemon when BMP post-policy RIB-out monitoring is onCVE-2026-101949 · Juniper Junos OS / Junos OS Evolved rpd (VPN-flowspec re-advertisement with BMP post-policy RIB-out)High
- Junos rpd: malformed BGP MCAST-TREE update crashes the routing daemon on re-advertisementCVE-2026-101951 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-TREE NLRI re-advertisement)High
- Junos rpd: ISO-VPN update processed by BMP route monitoring or NSR crashes the routing daemonCVE-2026-101952 · Juniper Junos OS / Junos OS Evolved rpd (ISO-VPN route export to BMP / NSR)High
- Junos rpd: LLGR-stale route re-advertised to a non-LLGR peer group crashes the routing daemonCVE-2026-101957 · Juniper Junos OS / Junos OS Evolved rpd (long-lived graceful restart stale-route re-advertisement)High
- Junos routing policy: nexthop-ecmp qualifier on a BGP import policy lets a peer crash the routing daemonCVE-2026-101961 · Juniper Junos OS / Junos OS Evolved routing-policy nexthop-ECMP matcherHigh
- Junos rpd: incorrect calculation crashes the routing daemon when SRv6 EVPN multihoming is configuredCVE-2026-101963 · Juniper Junos OS / Junos OS Evolved rpd (SRv6 EVPN multihoming)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.