Junos rpd: malformed EVPN NLRI crashes the routing daemon

CVSS 8.7CVE-2026-102183Firmware, BMC & network fabriccurated

Impact

A configured EVPN peer that sends a malformed NLRI crashes rpd, dropping routing adjacencies on the device until the daemon restarts and reconverges. This one needs no telemetry subscription - plain EVPN peering is enough, which makes it the most broadly exposed of the EVPN parsing bugs in JSA112187 for an EVPN-VXLAN GPU fabric. Overlay route state across the affected leaf or spine is unavailable during the restart, so tenant east-west and storage paths through it fail. The record describes availability loss only, with no indication of code execution.

Who can reach it

A configured BGP EVPN peer - established peering is the only requirement, no additional authentication.

What to do

Upgrade to a Junos OS / Junos OS Evolved release fixed per JSA112187; that is a routing-engine reload per device, so it needs a maintenance window per fabric node and dual-homed uplinks to avoid dropping the GPU nodes behind it. Until then the only lever the record supports is limiting which peers can open EVPN sessions. Fixed versions are in the advisory, not in this record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102183 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.