Database/Firmware, BMC & network fabric
Junos rpd: malformed BGP SRv6 service route crashes the routing daemon when SRv6 dynamic tunnels are enabled
Impact
A malformed BGP-signaled SRv6 service route crashes rpd on devices with SRv6 dynamic tunnels enabled, and the record describes the peer as remote and unauthenticated. Dynamic tunnels mean the device builds tunnel state from what BGP tells it, so the attacker's input reaches deeper into the forwarding setup than a plain route advertisement would.
Who can reach it
A remote unauthenticated BGP peer able to advertise an SRv6 service route. Requires SRv6 dynamic tunnels enabled.
What to do
Upgrade Junos OS / Junos OS Evolved to a release listed in Juniper JSA112187; the upgrade reboots the device. Disabling SRv6 dynamic tunnels removes the trigger where the design allows it.
References
Related entries
- Junos OS: stack overflow in the dot1x daemon lets an ICCP peer crash or own a Fusion ADCVE-2026-102069 · Juniper Junos OS dot1x daemon on Fusion Aggregation Devices (ICCP sync)High
- Junos OS MX/SPC3: malformed IPv6 packets exhaust NAT sessions until the device is rebootedCVE-2026-102077 · Juniper Junos OS Packet Forwarding Engine on MX Series with SPC3 (source NAT session handling)High
- Junos OS SRX/MX with SPC3: PFE memory leak under connection churn causes complete traffic lossCVE-2026-102081 · Juniper Junos OS Packet Forwarding Engine on SRX4000/SRX5000 and MX with SPC3 (service plugin memory leak)High
- Junos OS on SRX: stack overflow in iked lets an authenticated VPN client run code as rootCVE-2026-102174 · Juniper Junos OS on SRX Series (iked, remote-access VPN authentication and JIMS identity publishing)High
- Junos OS: buffer overflow in the SDK service process can compromise the Routing EngineCVE-2026-102176 · Juniper Junos OS SDK service process (JDAF routing instance)High
- Junos rpd: out-of-bounds write in EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribedCVE-2026-102179 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, l2vpn-evpn RIB telemetry sensor)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.