Junos OS: buffer overflow in the SDK service process can compromise the Routing Engine

Impact

When the SDK service and a JDAF routing instance are enabled, specific packets overflow a buffer in the SDK service process and can either deny service or compromise the Routing Engine. The Routing Engine is the control plane of the device: an attacker there can rewrite forwarding, mirror traffic, or drop the box off the fabric. For a cluster whose east-west traffic crosses the device, that is a tenant-crossing position, not a single-host problem. The exposure depends on a configuration most devices do not run - confirm the SDK service and JDAF instance are enabled before treating it as urgent.

Who can reach it

Network, unauthenticated, when the SDK service and a JDAF routing instance are configured. Juniper's vector records adjacent attack reachability; in practice, anyone who can deliver the specific packets to the device's control plane.

What to do

Upgrade to a fixed Junos release listed in Juniper advisory JSA112188; the record carries no fixed versions. Expect a reboot per device. If the SDK service or the JDAF routing instance is not configured, the path is not reachable - verify this first rather than scheduling the window.

References

Related entries

• Junos rpd: out-of-bounds write in EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribedCVE-2026-102179 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, l2vpn-evpn RIB telemetry sensor)High
• Junos rpd: stack buffer overflow on a crafted BGP route attribute while a BGP RIB telemetry subscription is activeCVE-2026-102180 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, BGP RIB streaming telemetry)High
• Junos rpd: malformed EVPN NLRI crashes the routing daemonCVE-2026-102183 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, EVPN NLRI parsing)High
• Junos rpd: malformed SRv6 structure in an EVPN route update crashes the routing daemonCVE-2026-102184 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, SRv6 structure in EVPN route updates)High
• Junos rpd: infinite loop in EVPN multihoming preference-based DF election causes denial of serviceCVE-2026-102185 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, EVPN multihoming designated-forwarder election)High
• Junos OS: heap overflow in vgd lets a compromised SDN controller down the OVSDB control planeCVE-2026-103994 · Juniper Junos OS VXLAN Gateway Daemon (vgd, OVSDB control plane)High