Database/Firmware, BMC & network fabric
Junos rpd: BGP-LS updates hit a reachable assertion and crash the routing daemon
Impact
BGP-LS updates reach an assertion in rpd and crash the routing daemon. Juniper assigned three ids to reachable assertions in BGP-LS processing in this advisory (CVE-2026-102020, CVE-2026-102022 for crafted Link NLRI, and CVE-2026-102044); same subsystem, same class, same fix, so they are recorded as one entry. BGP-LS is how a controller or traffic-engineering system learns the fabric topology, so the peers that can trigger this are usually the SDN controllers an operator trusts most - and a crash there costs both routing and the topology feed.
Who can reach it
An attacker with access to a configured BGP-LS peer session - a controller, route reflector, or anything able to establish or hijack that peering. The records describe the attacker variously as authenticated or as holding peer access; no device login is needed.
What to do
Upgrade Junos OS / Junos OS Evolved to a release from Juniper JSA112187; the upgrade reboots the device. Where BGP-LS is not required, removing the link-state address family from those sessions removes the trigger without a reboot.
Also covers 2 CVEs
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- Junos OS Evolved fwstatsd: SNMP firewall-counter query crashes the statistics daemonCVE-2026-102023 · Juniper Junos OS Evolved fwstatsd (SNMP firewall-counter MIB)High
- Junos rpd: integer overflow in extended-nexthop-tunnel processing crashes the routing daemonCVE-2026-102024 · Juniper Junos OS / Junos OS Evolved rpd (BGP extended-nexthop-tunnel)High
- Junos rpd: mismatched memory management crashes the routing daemon on SRv6 service routes over tunnelled next-hopsCVE-2026-102025 · Juniper Junos OS / Junos OS Evolved rpd (extended next-hop tunneling with SRv6 service processing)High
- Junos rpd: BGP route update crashes the routing daemon when RIB sharding is enabledCVE-2026-102026 · Juniper Junos OS / Junos OS Evolved rpd (RIB sharding)High
- Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are onCVE-2026-102027 · Juniper Junos OS / Junos OS Evolved rpd (BGP labeled-unicast multipath buffer sizing)High
- Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-onlyCVE-2026-102028 · Juniper Junos OS / Junos OS Evolved rpd (BGP family l2vpn auto-discovery-only)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.