Database/Firmware, BMC & network fabric
Junos rpd: mismatched memory management crashes the routing daemon on SRv6 service routes over tunnelled next-hops
Impact
When extended next-hop tunneling and SRv6 service processing are both in use, a BGP route update triggers mismatched memory management routines in rpd and causes a denial of service. This is a distinct defect from the integer overflow in the same feature area: the fix and the trigger conditions differ, so both need to be covered by whatever release an operator moves to. SRv6 fabrics are a newer deployment pattern, which means fewer operators are affected but also fewer have a tested upgrade path ready.
Who can reach it
An authenticated network-based BGP peer sending a route update. Requires extended next-hop tunneling together with SRv6 service processing.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187, checking that the release you pick covers the other extended-next-hop and SRv6 ids in the same advisory. The upgrade reboots the device.
References
Related entries
- Junos rpd: BGP route update crashes the routing daemon when RIB sharding is enabledCVE-2026-102026 · Juniper Junos OS / Junos OS Evolved rpd (RIB sharding)High
- Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are onCVE-2026-102027 · Juniper Junos OS / Junos OS Evolved rpd (BGP labeled-unicast multipath buffer sizing)High
- Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-onlyCVE-2026-102028 · Juniper Junos OS / Junos OS Evolved rpd (BGP family l2vpn auto-discovery-only)High
- Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemonCVE-2026-102029 · Juniper Junos OS / Junos OS Evolved rpd (MSDP/PIM policy AS-path expansion)High
- Junos rpd: BGP MVPN update crashes the routing daemon when an inter-region template is configuredCVE-2026-102030 · Juniper Junos OS / Junos OS Evolved rpd (MVPN inter-region segmented VRF)High
- Junos l2ald: EVPN Type-2 MAC/IP routes trigger an integer overflow and a Layer 2 learning outageCVE-2026-102036 · Juniper Junos OS / Junos OS Evolved l2ald (EVPN Type-2 MAC/IP route handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.