Database/Firmware, BMC & network fabric
Junos rpd: BGP route update crashes the routing daemon when RIB sharding is enabled
Impact
Improper control of a resource through its lifetime in rpd lets an adjacent eBGP peer crash the routing daemon with a BGP route update when RIB sharding is enabled. RIB sharding is turned on specifically to handle large route tables and high update rates - the configuration a large fabric or a route reflector needs - so the devices carrying the most state are the exposed ones.
Who can reach it
An adjacent eBGP peer sending a route update. Requires RIB sharding enabled on the device.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device, and on a route reflector plan for the control-plane gap. Disabling RIB sharding is a scaling regression, so treat it as a last-resort mitigation rather than the default one.
References
Related entries
- Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are onCVE-2026-102027 · Juniper Junos OS / Junos OS Evolved rpd (BGP labeled-unicast multipath buffer sizing)High
- Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-onlyCVE-2026-102028 · Juniper Junos OS / Junos OS Evolved rpd (BGP family l2vpn auto-discovery-only)High
- Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemonCVE-2026-102029 · Juniper Junos OS / Junos OS Evolved rpd (MSDP/PIM policy AS-path expansion)High
- Junos rpd: BGP MVPN update crashes the routing daemon when an inter-region template is configuredCVE-2026-102030 · Juniper Junos OS / Junos OS Evolved rpd (MVPN inter-region segmented VRF)High
- Junos l2ald: EVPN Type-2 MAC/IP routes trigger an integer overflow and a Layer 2 learning outageCVE-2026-102036 · Juniper Junos OS / Junos OS Evolved l2ald (EVPN Type-2 MAC/IP route handling)High
- Junos OS on MX: infinite loop in netsctp.ko lets crafted SCTP traffic hang the deviceCVE-2026-102046 · Juniper Junos OS netsctp.ko on MX Series (SCTP processing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.