Database/Firmware, BMC & network fabric
Junos rpd: eBGP peer causes a persistent routing-daemon outage when ephemeral configuration is used
Impact
On devices using the ephemeral configuration database, a specific BGP packet from a configured eBGP peer dereferences a NULL pointer in rpd and causes a persistent routing-daemon denial of service. Persistent is the word that matters: unlike the crash-and-restart bugs in this advisory, recovery is not automatic, so a single packet can hold a fabric device's control plane down until an operator intervenes. Ephemeral configuration is used by automation and SDN controllers, so the fleets most likely to be affected are the ones managed programmatically.
Who can reach it
A configured eBGP peer sending a specific BGP packet. Requires ephemeral configuration in use on the device.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Because the outage is persistent, treat this as higher priority than the other rpd crashes in the advisory on any device driven by automation that writes ephemeral configuration. The record names no configuration mitigation other than not using the ephemeral database.
References
Related entries
- Junos OS Evolved bootzd on PTX: crafted gRPC provisioning response executes commands as rootCVE-2026-101978 · Juniper Junos OS Evolved bootzd on PTX Series (ZTP gRPC response handling)High
- Junos authd: SNMP read access escalates to root code execution via a stack overflowCVE-2026-101979 · Juniper Junos OS / Junos OS Evolved authd (SNMP request handling)High
- Junos rpd: malformed LDP Label Mapping message crashes rpd or executes arbitrary codeCVE-2026-101981 · Juniper Junos OS / Junos OS Evolved rpd (LDP Label Mapping message parsing)High
- Junos OS Evolved na-grpcd: unauthenticated gRPC subscription request crashes the telemetry daemonCVE-2026-102012 · Juniper Junos OS Evolved na-grpcd (gRPC telemetry subscription)High
- Junos OS: stack overflow in authd gives root on the device to whoever controls the RADIUS serverCVE-2026-102014 · Juniper Junos OS authd (RADIUS response parsing)High
- Junos secure-dot1xd: EAPOL frame on an 802.1X interface gives root code executionCVE-2026-102015 · Juniper Junos OS / Junos OS Evolved secure-dot1xd (EAPOL frame handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.