Junos rpd: incorrect calculation crashes the routing daemon when SRv6 EVPN multihoming is configured

Impact

On devices configured for SRv6 EVPN multihoming, an incorrect calculation in rpd lets a BGP EVPN neighbour crash the routing daemon. Multihoming is used precisely where an operator wanted redundancy, so the bug sits in the feature meant to keep a GPU rack reachable when one uplink fails. The exposure is limited to fabrics that have adopted SRv6 with EVPN multihoming.

Who can reach it

A remote BGP EVPN neighbour of the device. No authentication beyond the established peering. Requires SRv6 EVPN multihoming configured.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device and should be sequenced so that multihomed pairs are never both down. The record names no mitigation other than not running SRv6 EVPN multihoming.

References

Related entries

• Junos OS Evolved gRPC daemon: format string in gNMI messages risks root code executionCVE-2026-101965 · Juniper Junos OS Evolved gRPC daemon (gNMI service)High
• Junos OS: NULL dereference in pkid during CMP enrollment is a remote denial of serviceCVE-2026-101973 · Juniper Junos OS pkid (CMP certificate enrollment)High
• Junos rpd: malformed BGP update from a peer without four-octet-AS capability causes an out-of-bounds writeCVE-2026-101976 · Juniper Junos OS / Junos OS Evolved rpd (BGP four-octet-AS attribute handling)High
• Junos rpd: eBGP peer causes a persistent routing-daemon outage when ephemeral configuration is usedCVE-2026-101977 · Juniper Junos OS / Junos OS Evolved rpd (ephemeral configuration database)High
• Junos OS Evolved bootzd on PTX: crafted gRPC provisioning response executes commands as rootCVE-2026-101978 · Juniper Junos OS Evolved bootzd on PTX Series (ZTP gRPC response handling)High
• Junos authd: SNMP read access escalates to root code execution via a stack overflowCVE-2026-101979 · Juniper Junos OS / Junos OS Evolved authd (SNMP request handling)High