Database/Firmware, BMC & network fabric
Junos rpd: flow-spec update selected for re-advertisement overflows a stack buffer, up to routing-engine compromise
Impact
A BGP flow-spec update that the device selects for re-advertisement overflows a stack buffer in the routing daemon, crashing rpd on Junos OS Evolved and allowing routing-engine code execution on Junos OS. Juniper split this flow-spec re-advertisement overflow across two ids in the same advisory (CVE-2026-101990 and CVE-2026-102178, the latter conditioned on BGP update-threading); same component, same class of flaw, same fix, so they are recorded as one. Compromise of the routing engine on a fabric router is the worst case here - the attacker owns route selection for the traffic the cluster depends on, and a route-reflector or border router is not a device you can fail over cheaply.
Who can reach it
A configured BGP flow-spec peer, i.e. a neighbour the device already accepts flow-spec routes from. No authentication beyond an established BGP session. CVE-2026-102178 additionally requires BGP update-threading to be enabled.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release from Juniper JSA112187. This is a reboot per device; on route reflectors and border routers plan for the control-plane outage, not just the data-plane one. If flow-spec is not required, removing the flow-spec address family from those sessions, or disabling flow-spec re-advertisement, removes the trigger without an upgrade.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- Junos OS Evolved: low-privileged TACACS+ user escalates to root via authorization refreshCVE-2026-102031 · Juniper Junos OS Evolved TACACS+ authorization-refresh handlingCritical
- Junos sdxd: heap overflow on the SDX/SRC connection yields root code execution on the deviceCVE-2026-102175 · Juniper Junos OS / Junos OS Evolved sdxd (service-deployment daemon)Critical
- Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packetsCVE-2026-102182 · Juniper Junos OS kmd on MX Series (IKE certificate-based packet handling)Critical
- Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestationCVE-2026-22696 · Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestation…Critical
- Junos OS on SRX: stack overflow in srxpfe gives unauthenticated root code execution via a crafted GRE packetCVE-2026-33792 · Juniper Junos OS on SRX Series (srxpfe, GRE tunnel packet handling)Critical
- Voltronic Power SNMP Web Pro: unauthenticated firmware upload yields root on the UPS management cardCVE-2026-44402 · Voltronic Power SNMP Web Pro 1.1 (upload.cgi firmware update endpoint)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.