Junos rpd: BGP MVPN signaling update from a configured peer crashes the routing daemon

Impact

rpd fails to validate a specified quantity in a BGP MVPN signaling update, letting a configured MVPN peer cause a denial of service. Multicast VPN signalling is a narrower feature than unicast BGP, so this applies only to fabrics carrying MVPN, but where it does the crash takes all routing on the device with it, not just multicast state.

Who can reach it

A configured BGP MVPN peer. No authentication beyond the established peering.

What to do

Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Where MVPN is not required, removing that address family from the sessions removes the trigger without a reboot.

References

Related entries

• Junos rpd: BGP-LS updates hit a reachable assertion and crash the routing daemonCVE-2026-102020 · Juniper Junos OS / Junos OS Evolved rpd (BGP-LS NLRI processing)High
• Junos OS Evolved fwstatsd: SNMP firewall-counter query crashes the statistics daemonCVE-2026-102023 · Juniper Junos OS Evolved fwstatsd (SNMP firewall-counter MIB)High
• Junos rpd: integer overflow in extended-nexthop-tunnel processing crashes the routing daemonCVE-2026-102024 · Juniper Junos OS / Junos OS Evolved rpd (BGP extended-nexthop-tunnel)High
• Junos rpd: mismatched memory management crashes the routing daemon on SRv6 service routes over tunnelled next-hopsCVE-2026-102025 · Juniper Junos OS / Junos OS Evolved rpd (extended next-hop tunneling with SRv6 service processing)High
• Junos rpd: BGP route update crashes the routing daemon when RIB sharding is enabledCVE-2026-102026 · Juniper Junos OS / Junos OS Evolved rpd (RIB sharding)High
• Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are onCVE-2026-102027 · Juniper Junos OS / Junos OS Evolved rpd (BGP labeled-unicast multipath buffer sizing)High