Database/Firmware, BMC & network fabric
Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are on
Impact
An incorrect buffer-size calculation in rpd lets a configured eBGP neighbour crash the routing daemon with BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Multipath on labeled unicast is standard where traffic is spread across parallel paths, which describes most GPU fabrics with an MPLS or SR underlay. The advisory does not name the specific multipath knobs, so inventory which ones are enabled rather than assuming you are out of scope.
Who can reach it
A configured eBGP neighbour sending labeled-unicast updates. Requires the affected multipath features enabled; the record does not enumerate them.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Because the record does not name the exact multipath configuration, do not rely on a configuration-level mitigation here - confirm the affected knobs with Juniper or patch.
References
Related entries
- Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-onlyCVE-2026-102028 · Juniper Junos OS / Junos OS Evolved rpd (BGP family l2vpn auto-discovery-only)High
- Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemonCVE-2026-102029 · Juniper Junos OS / Junos OS Evolved rpd (MSDP/PIM policy AS-path expansion)High
- Junos rpd: BGP MVPN update crashes the routing daemon when an inter-region template is configuredCVE-2026-102030 · Juniper Junos OS / Junos OS Evolved rpd (MVPN inter-region segmented VRF)High
- Junos l2ald: EVPN Type-2 MAC/IP routes trigger an integer overflow and a Layer 2 learning outageCVE-2026-102036 · Juniper Junos OS / Junos OS Evolved l2ald (EVPN Type-2 MAC/IP route handling)High
- Junos OS on MX: infinite loop in netsctp.ko lets crafted SCTP traffic hang the deviceCVE-2026-102046 · Juniper Junos OS netsctp.ko on MX Series (SCTP processing)High
- Junos l2cpd: LLDP packets overflow a stack buffer, root code execution or Layer 2 control-plane denial of serviceCVE-2026-102049 · Juniper Junos OS / Junos OS Evolved l2cpd (LLDP processing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.