Junos OS rpd: malformed OSPF packet from an adjacent peer leaks rpd memory or crashes routing

CVSS 7.1CVE-2026-101974Firmware, BMC & network fabriccurated

Impact

An adjacent OSPF speaker sends malformed packets and either reads back fragments of rpd memory or kills the routing daemon. On a Juniper switch or router carrying datacenter traffic, an rpd crash drops the control plane: adjacencies tear down, routes withdraw, and anything transiting that device loses reachability until rpd restarts and reconverges. For a GPU fleet the pain is that storage and north-south paths for whole racks sit behind these devices, so a repeatable crash is a repeatable outage for jobs that cannot checkpoint cheaply. The memory disclosure side is secondary but can expose routing state an attacker would otherwise have to infer.

Who can reach it

Adjacent network - the attacker must be an OSPF peer of the device, so this requires a position on a segment where OSPF adjacencies are formed. No authentication beyond whatever OSPF authentication is configured.

What to do

Upgrade to a fixed Junos OS or Junos OS Evolved release per Juniper advisory JSA112187; the NVD record does not list the fixed versions, so read the advisory for the release matrix. A Junos upgrade means a reboot or at least an rpd restart on each device, which is a maintenance window per switch - schedule it around the redundancy you have rather than per node. Interim mitigation is to restrict which segments can form OSPF adjacencies and to enable OSPF authentication so arbitrary adjacent hosts cannot speak OSPF to the device.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101974 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.