Database/Firmware, BMC & network fabric
Junos httpd: stack overflow gives unauthenticated remote code execution when a J-Web virtual-domain is configured
Impact
A stack-based buffer overflow in the httpd process serving J-Web lets an unauthenticated attacker execute code on the device or crash the management daemon. Code execution in httpd on a Junos box is a path onto the control plane of fabric hardware; a crash costs management reachability at the moment an operator most wants it. Only devices with a J-Web virtual-domain configured are affected, which narrows the fleet but makes the exposed subset easy to overlook during inventory.
Who can reach it
Any host that can reach the J-Web HTTP/HTTPS service on a device with a virtual-domain configured. No authentication required.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187 - the advisory carries the per-platform fixed releases. Expect a reboot per device and a maintenance window for each affected leaf or spine. Removing the J-Web virtual-domain configuration, or disabling web management entirely, mitigates without an upgrade.
References
Related entries
- Junos J-Web: crafted HTTP request bypasses authentication and runs CGI content with elevated privilegesCVE-2026-101986 · Juniper Junos OS / Junos OS Evolved J-Web (authentication layer, CGI dispatch)Critical
- Junos rpd: flow-spec update selected for re-advertisement overflows a stack buffer, up to routing-engine compromiseCVE-2026-101990 · Juniper Junos OS / Junos OS Evolved rpd (BGP flow-spec route re-advertisement)Critical
- Junos OS Evolved: low-privileged TACACS+ user escalates to root via authorization refreshCVE-2026-102031 · Juniper Junos OS Evolved TACACS+ authorization-refresh handlingCritical
- Junos sdxd: heap overflow on the SDX/SRC connection yields root code execution on the deviceCVE-2026-102175 · Juniper Junos OS / Junos OS Evolved sdxd (service-deployment daemon)Critical
- Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packetsCVE-2026-102182 · Juniper Junos OS kmd on MX Series (IKE certificate-based packet handling)Critical
- Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestationCVE-2026-22696 · Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestation…Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.