Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-only

Impact

With bgp family l2vpn auto-discovery-only configured, multiple UPDATEs arriving over a single TCP session dereference a NULL pointer in rpd and cause a denial of service. The trigger is volume on one session rather than a single crafted packet, so it can also fire accidentally during a convergence event - meaning an operator may see this as an unexplained rpd crash before they see it as an attack.

Who can reach it

A remote BGP peer sending multiple UPDATEs over one session. Requires the l2vpn auto-discovery-only family configured.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Removing the l2vpn auto-discovery-only configuration where it is not needed removes the trigger with a commit.

References

Related entries

• Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemonCVE-2026-102029 · Juniper Junos OS / Junos OS Evolved rpd (MSDP/PIM policy AS-path expansion)High
• Junos rpd: BGP MVPN update crashes the routing daemon when an inter-region template is configuredCVE-2026-102030 · Juniper Junos OS / Junos OS Evolved rpd (MVPN inter-region segmented VRF)High
• Junos l2ald: EVPN Type-2 MAC/IP routes trigger an integer overflow and a Layer 2 learning outageCVE-2026-102036 · Juniper Junos OS / Junos OS Evolved l2ald (EVPN Type-2 MAC/IP route handling)High
• Junos OS on MX: infinite loop in netsctp.ko lets crafted SCTP traffic hang the deviceCVE-2026-102046 · Juniper Junos OS netsctp.ko on MX Series (SCTP processing)High
• Junos l2cpd: LLDP packets overflow a stack buffer, root code execution or Layer 2 control-plane denial of serviceCVE-2026-102049 · Juniper Junos OS / Junos OS Evolved l2cpd (LLDP processing)High
• Junos jdhcpd: malformed DHCPv4 server response gives root code execution on the deviceCVE-2026-102052 · Juniper Junos OS / Junos OS Evolved jdhcpd (DHCPv4 local-client)High