Database/Firmware, BMC & network fabric
Junos rpd: ISO-VPN update processed by BMP route monitoring or NSR crashes the routing daemon
Impact
A specific ISO-VPN update from a configured BGP peer crashes rpd once it is processed by BMP route monitoring or by nonstop routing. The second path matters: NSR exists to keep routing alive across a routing-engine switchover, so the feature an operator enabled for resilience is the one that turns a peer's update into a crash. Devices running either BMP export or NSR with ISO-VPN peers are the affected set.
Who can reach it
A configured BGP ISO-VPN peer. No authentication beyond the peering. Requires BMP route monitoring or NSR to be in use.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Disabling BMP route monitoring removes one trigger path without a reboot; disabling NSR is not a sensible trade on a core device, so patching is the real answer there.
References
Related entries
- Junos rpd: LLGR-stale route re-advertised to a non-LLGR peer group crashes the routing daemonCVE-2026-101957 · Juniper Junos OS / Junos OS Evolved rpd (long-lived graceful restart stale-route re-advertisement)High
- Junos routing policy: nexthop-ecmp qualifier on a BGP import policy lets a peer crash the routing daemonCVE-2026-101961 · Juniper Junos OS / Junos OS Evolved routing-policy nexthop-ECMP matcherHigh
- Junos rpd: incorrect calculation crashes the routing daemon when SRv6 EVPN multihoming is configuredCVE-2026-101963 · Juniper Junos OS / Junos OS Evolved rpd (SRv6 EVPN multihoming)High
- Junos OS Evolved gRPC daemon: format string in gNMI messages risks root code executionCVE-2026-101965 · Juniper Junos OS Evolved gRPC daemon (gNMI service)High
- Junos OS: NULL dereference in pkid during CMP enrollment is a remote denial of serviceCVE-2026-101973 · Juniper Junos OS pkid (CMP certificate enrollment)High
- Junos rpd: malformed BGP update from a peer without four-octet-AS capability causes an out-of-bounds writeCVE-2026-101976 · Juniper Junos OS / Junos OS Evolved rpd (BGP four-octet-AS attribute handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.