Database/Firmware, BMC & network fabric
Junos rpd: malformed BGP update from a peer without four-octet-AS capability causes an out-of-bounds write
Impact
An eBGP peer that has not negotiated the four-octet-AS capability can send a malformed update that triggers an out-of-bounds write in rpd, causing a denial of service. Unlike the feature-gated bugs in this advisory, the trigger is a plain BGP session with an old capability profile, so the exposed configuration surface is wide. An rpd outage on a border or spine device drops the routes a GPU cluster needs for storage and external access.
Who can reach it
An eBGP peer that has not negotiated four-octet-AS capability, i.e. any configured external neighbour the device accepts updates from. No authentication beyond the established session.
What to do
Upgrade Junos OS / Junos OS Evolved to a release in Juniper JSA112187. The upgrade reboots the device; sequence spines and border routers so the fabric keeps a path while each is down. The record names no configuration-level mitigation, so restricting which external peers can establish sessions is the only interim lever.
References
Related entries
- Junos rpd: eBGP peer causes a persistent routing-daemon outage when ephemeral configuration is usedCVE-2026-101977 · Juniper Junos OS / Junos OS Evolved rpd (ephemeral configuration database)High
- Junos OS Evolved bootzd on PTX: crafted gRPC provisioning response executes commands as rootCVE-2026-101978 · Juniper Junos OS Evolved bootzd on PTX Series (ZTP gRPC response handling)High
- Junos authd: SNMP read access escalates to root code execution via a stack overflowCVE-2026-101979 · Juniper Junos OS / Junos OS Evolved authd (SNMP request handling)High
- Junos rpd: malformed LDP Label Mapping message crashes rpd or executes arbitrary codeCVE-2026-101981 · Juniper Junos OS / Junos OS Evolved rpd (LDP Label Mapping message parsing)High
- Junos OS Evolved na-grpcd: unauthenticated gRPC subscription request crashes the telemetry daemonCVE-2026-102012 · Juniper Junos OS Evolved na-grpcd (gRPC telemetry subscription)High
- Junos OS: stack overflow in authd gives root on the device to whoever controls the RADIUS serverCVE-2026-102014 · Juniper Junos OS authd (RADIUS response parsing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.