Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemon

Impact

A NULL dereference in rpd is reachable from an unauthenticated configured MSDP peer or an adjacent PIM sender when an MSDP or PIM policy uses AS-path expansion. Two different protocols reach the same fault, so an operator checking only MSDP peering could miss the PIM path on a directly attached segment. Result is a routing-daemon outage on the device.

Who can reach it

An unauthenticated configured MSDP peer, or a PIM sender adjacent to the device. Requires an MSDP or PIM policy that uses AS-path expansion.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Removing AS-path expansion from MSDP and PIM policies removes the trigger without a reboot where the policy intent survives it.

References

Related entries

• Junos rpd: BGP MVPN update crashes the routing daemon when an inter-region template is configuredCVE-2026-102030 · Juniper Junos OS / Junos OS Evolved rpd (MVPN inter-region segmented VRF)High
• Junos l2ald: EVPN Type-2 MAC/IP routes trigger an integer overflow and a Layer 2 learning outageCVE-2026-102036 · Juniper Junos OS / Junos OS Evolved l2ald (EVPN Type-2 MAC/IP route handling)High
• Junos OS on MX: infinite loop in netsctp.ko lets crafted SCTP traffic hang the deviceCVE-2026-102046 · Juniper Junos OS netsctp.ko on MX Series (SCTP processing)High
• Junos l2cpd: LLDP packets overflow a stack buffer, root code execution or Layer 2 control-plane denial of serviceCVE-2026-102049 · Juniper Junos OS / Junos OS Evolved l2cpd (LLDP processing)High
• Junos jdhcpd: malformed DHCPv4 server response gives root code execution on the deviceCVE-2026-102052 · Juniper Junos OS / Junos OS Evolved jdhcpd (DHCPv4 local-client)High
• Junos cfmd: CFM message to a down-MEP executes code as root with enhanced CFM mode enabledCVE-2026-102055 · Juniper Junos OS cfmd on MX Series / Junos OS Evolved on PTX Series (enhanced CFM)High