Database/Firmware, BMC & network fabric
Junos OS Evolved kernel: crafted TCP packet panics the switch when BGP/LDP key-chain auth is used
Impact
A stack buffer overflow in the kernel's handling of authenticated TCP sessions lets an unauthenticated remote attacker crash a Junos OS Evolved device with a single crafted packet, provided the device uses key-chain authentication for BGP or LDP. A kernel panic on a leaf or spine drops every link through it: collective operations across the affected pod stall, RDMA storage mounts time out, and jobs spanning the rack fail rather than degrade. The flaw is reachable by anyone who can land TCP packets on the routing protocol port, which on an internet-facing or peering-facing device means off-net attackers. Juniper scored it 9.2 with availability impact only - there is no indication of code execution in this record.
Who can reach it
Network: anyone able to send TCP packets to the device's BGP or LDP listener. No authentication required; the device must have key-chain authentication configured for BGP or LDP.
What to do
Upgrade to the Junos OS Evolved release identified in JSA112250; the upgrade reboots the device, so sequence it through the fabric one element at a time. Where the upgrade must wait, restrict which peers can reach the BGP/LDP ports with infrastructure ACLs or GTSM, and review whether key-chain authentication is needed on every session. Fixed versions are not in the record.
References
Related entries
- Junos OS: reachable assertion in the TWAMP client lets one TCP packet kill rmopdCVE-2026-102070 · Juniper Junos OS rmopd (TWAMP client)Critical
- Junos OS on SRX: malformed ADVPN peer attributes overflow the VPN daemon and take over the deviceCVE-2026-102084 · Juniper Junos OS VPN daemon on SRX Series (ADVPN peer message validation)Critical
- Junos rpd: BGP updates processed by BMP route monitoring overflow a stack buffer, up to root executionCVE-2026-33789 · Juniper Junos OS / Junos OS Evolved rpd (BGP Monitoring Protocol route export)Critical
- Linux kernel bnxt_re: doorbell page allocation reports success when ioremap fails, leaving unwound driver stateCVE-2026-72496 · Linux kernel bnxt_re RoCE driver (bnxt_qplib_alloc_dpi doorbell ioremap error path)Critical
- Arista EOS gNPSI: unauthenticated request yields arbitrary code execution on the switchCVE-2026-73456 · Arista EOS (gNPSI - gRPC Network Packet Sampling Interface)Critical
- Arista EOS: crafted packet brings down authenticated BFD sessions and triggers routing changesCVE-2026-73458 · Arista EOS BFD (authenticated session packet handling)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.