Database/Firmware, BMC & network fabric
Junos routing policy: nexthop-ecmp qualifier on a BGP import policy lets a peer crash the routing daemon
Impact
A NULL dereference in the nexthop-ECMP matcher of the routing-policy engine lets a configured eBGP peer crash the routing daemon with a specific BGP packet, whenever a nexthop-ecmp qualifier is attached to a BGP import policy. ECMP-aware policy is common on fabrics precisely because GPU traffic is spread across many equal-cost rails, so the qualifier that exists to manage that spread is the precondition for the outage.
Who can reach it
A configured eBGP peer. No authentication beyond the established session. Requires a nexthop-ecmp qualifier in a BGP import policy.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Where the nexthop-ecmp qualifier can be removed from import policies without changing forwarding intent, that mitigates with a commit instead of a window.
References
Related entries
- Junos rpd: incorrect calculation crashes the routing daemon when SRv6 EVPN multihoming is configuredCVE-2026-101963 · Juniper Junos OS / Junos OS Evolved rpd (SRv6 EVPN multihoming)High
- Junos OS Evolved gRPC daemon: format string in gNMI messages risks root code executionCVE-2026-101965 · Juniper Junos OS Evolved gRPC daemon (gNMI service)High
- Junos OS: NULL dereference in pkid during CMP enrollment is a remote denial of serviceCVE-2026-101973 · Juniper Junos OS pkid (CMP certificate enrollment)High
- Junos rpd: malformed BGP update from a peer without four-octet-AS capability causes an out-of-bounds writeCVE-2026-101976 · Juniper Junos OS / Junos OS Evolved rpd (BGP four-octet-AS attribute handling)High
- Junos rpd: eBGP peer causes a persistent routing-daemon outage when ephemeral configuration is usedCVE-2026-101977 · Juniper Junos OS / Junos OS Evolved rpd (ephemeral configuration database)High
- Junos OS Evolved bootzd on PTX: crafted gRPC provisioning response executes commands as rootCVE-2026-101978 · Juniper Junos OS Evolved bootzd on PTX Series (ZTP gRPC response handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.