Database/Firmware, BMC & network fabric
Junos OS: stack overflow in jdhcpd lets an adjacent attacker break DHCP, relay and ZTP
Impact
A crafted DHCP client response overflows a stack buffer in jdhcpd and causes a denial of service. Taking down jdhcpd takes DHCP, DHCP relay and zero-touch provisioning with it, so hosts and devices that renew or boot while it is down do not get addresses. In a datacenter that provisions GPU nodes and switches through ZTP and relays tenant DHCP through the fabric, that is a provisioning freeze and, as leases expire, a progressive loss of addressing - a slow outage rather than an instant one, but one that recovers only when the daemon does.
Who can reach it
Adjacent network, unauthenticated. An attacker on a broadcast domain the device serves or relays for, able to send a DHCP response the device's client processes.
What to do
Upgrade to a fixed Junos release as listed in Juniper advisory JSA112188; fixed versions are not in this record. Expect a device reboot per upgrade. Interim: disable the DHCP client where it is not needed and restrict which segments can deliver DHCP responses to the device.
References
Related entries
- Junos phone-home daemon: rogue DHCP server injects OS commands and runs them as rootCVE-2026-102059 · Juniper Junos OS / Junos OS Evolved phcd (phone-home daemon) on EX, SRX, QFXHigh
- Junos phone-home daemon: crafted DHCP SZTP bootstrap message overflows a stack buffer, root executionCVE-2026-102061 · Juniper Junos OS / Junos OS Evolved phcd (Secure-ZTP DHCP bootstrap parsing)High
- Junos rpd: malformed BGP MCAST-VPN updates from an eBGP peer hit an assertion and crash rpdCVE-2026-102064 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-VPN update parsing)High
- Junos rpd: malformed BGP SRv6 service route crashes the routing daemon when SRv6 dynamic tunnels are enabledCVE-2026-102065 · Juniper Junos OS / Junos OS Evolved rpd (BGP-signaled SRv6 service routes, dynamic tunnels)High
- Junos OS: stack overflow in the dot1x daemon lets an ICCP peer crash or own a Fusion ADCVE-2026-102069 · Juniper Junos OS dot1x daemon on Fusion Aggregation Devices (ICCP sync)High
- Junos OS MX/SPC3: malformed IPv6 packets exhaust NAT sessions until the device is rebootedCVE-2026-102077 · Juniper Junos OS Packet Forwarding Engine on MX Series with SPC3 (source NAT session handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.