Database/Firmware, BMC & network fabric
Junos rpd: integer overflow in extended-nexthop-tunnel processing crashes the routing daemon
Impact
With extended-nexthop-tunnel enabled, BGP route updates from an authenticated peer overflow an integer in rpd and cause a denial of service. Extended next-hop tunnelling shows up in fabrics that stitch overlay next-hops across a tunnelled underlay, which includes some AI datacenter designs; where it is configured, any accepted peer can take the routing daemon down.
Who can reach it
An authenticated BGP peer of the device - in practice a configured neighbour on the fabric. Requires extended-nexthop-tunnel enabled.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Disabling extended-nexthop-tunnel, where the forwarding design does not depend on it, removes the trigger with a commit.
References
Related entries
- Junos rpd: mismatched memory management crashes the routing daemon on SRv6 service routes over tunnelled next-hopsCVE-2026-102025 · Juniper Junos OS / Junos OS Evolved rpd (extended next-hop tunneling with SRv6 service processing)High
- Junos rpd: BGP route update crashes the routing daemon when RIB sharding is enabledCVE-2026-102026 · Juniper Junos OS / Junos OS Evolved rpd (RIB sharding)High
- Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are onCVE-2026-102027 · Juniper Junos OS / Junos OS Evolved rpd (BGP labeled-unicast multipath buffer sizing)High
- Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-onlyCVE-2026-102028 · Juniper Junos OS / Junos OS Evolved rpd (BGP family l2vpn auto-discovery-only)High
- Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemonCVE-2026-102029 · Juniper Junos OS / Junos OS Evolved rpd (MSDP/PIM policy AS-path expansion)High
- Junos rpd: BGP MVPN update crashes the routing daemon when an inter-region template is configuredCVE-2026-102030 · Juniper Junos OS / Junos OS Evolved rpd (MVPN inter-region segmented VRF)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.