Junos rpd: malformed BGP MCAST-TREE update crashes the routing daemon on re-advertisement

Impact

A malformed BGP MCAST-TREE update whose NLRI the device then tries to re-advertise crashes rpd. The attacker is network-adjacent and already a configured peer, and the crash is repeatable as long as the update keeps arriving. Multicast tree signalling is not universal in GPU fabrics, so check whether the address family is configured before scheduling against this one.

Who can reach it

A network-adjacent configured BGP peer whose MCAST-TREE update the device attempts to re-advertise.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Removing the MCAST-TREE address family from sessions where it is not needed removes the trigger without a reboot.

References

Related entries

• Junos rpd: ISO-VPN update processed by BMP route monitoring or NSR crashes the routing daemonCVE-2026-101952 · Juniper Junos OS / Junos OS Evolved rpd (ISO-VPN route export to BMP / NSR)High
• Junos rpd: LLGR-stale route re-advertised to a non-LLGR peer group crashes the routing daemonCVE-2026-101957 · Juniper Junos OS / Junos OS Evolved rpd (long-lived graceful restart stale-route re-advertisement)High
• Junos routing policy: nexthop-ecmp qualifier on a BGP import policy lets a peer crash the routing daemonCVE-2026-101961 · Juniper Junos OS / Junos OS Evolved routing-policy nexthop-ECMP matcherHigh
• Junos rpd: incorrect calculation crashes the routing daemon when SRv6 EVPN multihoming is configuredCVE-2026-101963 · Juniper Junos OS / Junos OS Evolved rpd (SRv6 EVPN multihoming)High
• Junos OS Evolved gRPC daemon: format string in gNMI messages risks root code executionCVE-2026-101965 · Juniper Junos OS Evolved gRPC daemon (gNMI service)High
• Junos OS: NULL dereference in pkid during CMP enrollment is a remote denial of serviceCVE-2026-101973 · Juniper Junos OS pkid (CMP certificate enrollment)High