Database/Firmware, BMC & network fabric
Junos rpd: EVPN-VPWS route advertisements overflow a stack buffer, root execution on Junos OS
Impact
Protocol-valid route advertisements for an EVPN-VPWS service overflow a stack buffer in rpd: root code execution on Junos OS, an rpd crash on Junos OS Evolved. The advertisements are valid BGP, so nothing upstream of rpd will reject them. EVPN is the common control plane for VXLAN fabrics in AI datacenters, and a compromised or crashed rpd on a leaf takes the overlay for the GPU nodes behind it with it.
Who can reach it
A configured BGP/EVPN peer - a neighbouring fabric device or anything that can establish that session. No authentication beyond the configured peering. Requires an EVPN-VPWS service configured.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187. Each device reboots, so work rail by rail and drain GPU nodes whose only path runs through the switch being upgraded. No mitigation short of removing the EVPN-VPWS service is stated in the record.
References
Related entries
- Junos httpd: stack overflow gives unauthenticated remote code execution when a J-Web virtual-domain is configuredCVE-2026-101983 · Juniper Junos OS / Junos OS Evolved httpd (J-Web virtual-domain handling)Critical
- Junos J-Web: crafted HTTP request bypasses authentication and runs CGI content with elevated privilegesCVE-2026-101986 · Juniper Junos OS / Junos OS Evolved J-Web (authentication layer, CGI dispatch)Critical
- Junos rpd: flow-spec update selected for re-advertisement overflows a stack buffer, up to routing-engine compromiseCVE-2026-101990 · Juniper Junos OS / Junos OS Evolved rpd (BGP flow-spec route re-advertisement)Critical
- Junos OS Evolved: low-privileged TACACS+ user escalates to root via authorization refreshCVE-2026-102031 · Juniper Junos OS Evolved TACACS+ authorization-refresh handlingCritical
- Junos sdxd: heap overflow on the SDX/SRC connection yields root code execution on the deviceCVE-2026-102175 · Juniper Junos OS / Junos OS Evolved sdxd (service-deployment daemon)Critical
- Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packetsCVE-2026-102182 · Juniper Junos OS kmd on MX Series (IKE certificate-based packet handling)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.