Database/Firmware, BMC & network fabric
Junos rpd: VPN-flowspec update crashes the routing daemon when BMP post-policy RIB-out monitoring is on
Impact
A VPN-flowspec BGP update that is re-advertised while BMP post-policy RIB-out monitoring is configured dereferences a NULL pointer in rpd, crashing the routing daemon. The trigger needs both conditions - the route must be re-advertised and the BMP export must be enabled - so the affected set is the fleet that runs route monitoring, typically the one with the most mature telemetry. Distinct from the plain FlowSpec NULL dereference in the same advisory: here the fault is in the BMP export path, not in FlowSpec reception.
Who can reach it
An unauthenticated remote BGP neighbour whose VPN-flowspec update the device re-advertises, on a device with BMP post-policy RIB-out monitoring configured.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Disabling BMP post-policy RIB-out monitoring removes the trigger without an upgrade, at the cost of that telemetry stream.
References
Related entries
- Junos rpd: malformed BGP MCAST-TREE update crashes the routing daemon on re-advertisementCVE-2026-101951 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-TREE NLRI re-advertisement)High
- Junos rpd: ISO-VPN update processed by BMP route monitoring or NSR crashes the routing daemonCVE-2026-101952 · Juniper Junos OS / Junos OS Evolved rpd (ISO-VPN route export to BMP / NSR)High
- Junos rpd: LLGR-stale route re-advertised to a non-LLGR peer group crashes the routing daemonCVE-2026-101957 · Juniper Junos OS / Junos OS Evolved rpd (long-lived graceful restart stale-route re-advertisement)High
- Junos routing policy: nexthop-ecmp qualifier on a BGP import policy lets a peer crash the routing daemonCVE-2026-101961 · Juniper Junos OS / Junos OS Evolved routing-policy nexthop-ECMP matcherHigh
- Junos rpd: incorrect calculation crashes the routing daemon when SRv6 EVPN multihoming is configuredCVE-2026-101963 · Juniper Junos OS / Junos OS Evolved rpd (SRv6 EVPN multihoming)High
- Junos OS Evolved gRPC daemon: format string in gNMI messages risks root code executionCVE-2026-101965 · Juniper Junos OS Evolved gRPC daemon (gNMI service)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.