Junos rpd: LLGR-stale route re-advertised to a non-LLGR peer group crashes the routing daemon

CVSS 8.7CVE-2026-101957Firmware, BMC & network fabriccurated

Impact

An improper initialization in rpd crashes the routing daemon when an LLGR-stale route update from a peer is re-advertised to a configured non-LLGR peer group. The mixed configuration - some peer groups negotiating long-lived graceful restart, some not - is the normal state during a phased rollout, which is when operators are least likely to be watching for a new crash path. LLGR exists to keep forwarding during a control-plane restart, so this defeats the mechanism meant to limit exactly this kind of outage.

Who can reach it

A remote BGP peer whose LLGR-stale route update is re-advertised to a non-LLGR peer group. No authentication beyond the peering.

What to do

Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Making LLGR configuration consistent across peer groups removes the re-advertisement path, but verify the convergence behaviour you get as a result before relying on it as a mitigation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101957 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.