Junos OS rpd: crafted IS-IS SRv6 packet from an adjacent attacker crashes the routing daemon

CVSS 7.1CVE-2026-101987Firmware, BMC & network fabriccurated

Impact

With SRv6 and Flexible Algorithm enabled, a specific IS-IS packet from an adjacent attacker takes down rpd. The result is a routing control-plane outage on the device: IS-IS adjacencies and the SRv6 paths built on them go away, and traffic through that switch or router stops until rpd comes back and reconverges. Unlike the OSPF issue in the same advisory this is availability only - no memory disclosure - and it is gated on a specific feature combination, so a device not running SRv6 with Flexible Algorithm is not affected. Worth tracking separately from the OSPF bug because the affected protocol, the trigger condition and the exposure test are different, even though both land in rpd and share the advisory.

Who can reach it

Adjacent network - requires a position that can send IS-IS to the device, i.e. on a segment where IS-IS adjacencies form. Unauthenticated. Only devices with SRv6 and Flexible Algorithm configured are exposed.

What to do

Check configuration first: if SRv6 with Flexible Algorithm is not enabled, there is nothing to schedule. Where it is, upgrade to a fixed Junos OS or Junos OS Evolved release per Juniper advisory JSA112187 - the NVD record carries no fixed versions, so take them from the advisory. The upgrade means a per-device reboot or rpd restart, so plan it as a switch-by-switch maintenance window. Disabling Flexible Algorithm removes the trigger if your design can tolerate that; restricting which segments can form IS-IS adjacencies reduces who can reach it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101987 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.