Junos rpd: stack buffer overflow on a crafted BGP route attribute while a BGP RIB telemetry subscription is active

CVSS 8.7CVE-2026-102180Firmware, BMC & network fabriccurated

Impact

A BGP peer that can send a crafted route attribute overflows a stack buffer in rpd and takes the routing daemon down, interrupting all routing on that switch or router until rpd restarts and reconverges. Unlike the EVPN-specific issues in the same advisory this is plain BGP, so it applies to any Junos device in the fabric or at its border that runs BGP with streaming telemetry subscribed - the common state for a fabric under gNMI/Prometheus monitoring. A fabric node whose control plane keeps restarting cannot be drained cheaply: the GPU nodes behind it stay up but lose reachable paths. Only Junos 22.1R1 / 22.1R1-EVO and later are affected.

Who can reach it

Any configured BGP peering session - the attacker must be a peer (or control one), no further authentication; versions before 22.1R1 are not affected.

What to do

Upgrade to a fixed Junos OS / Junos OS Evolved release per JSA112187, which requires a routing-engine reload per device (graceful on dual-RE, a full reboot on single-RE platforms). Devices on releases earlier than 22.1R1 / 22.1R1-EVO need no action. Dropping the BGP RIB streaming telemetry subscription removes the precondition the record names, if an upgrade window is not available. No fixed version is stated in this record - take it from the advisory.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102180 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.