Junos rpd: malformed SRv6 structure in an EVPN route update crashes the routing daemon

CVSS 8.7CVE-2026-102184Firmware, BMC & network fabriccurated

Impact

An EVPN signaling peer sending a malformed SRv6 structure in a route update crashes rpd, which takes down routing adjacencies on that device until it restarts and reconverges. The exposure is narrower than the other EVPN parsers in JSA112187 because it is in the SRv6 handling path, so fabrics that do not carry SRv6 in EVPN updates are less likely to reach it - but the parse happens on received routes, not on local configuration, so an upstream peer decides what arrives. On a GPU fabric built on EVPN this is a control-plane outage on a leaf or spine, with overlay reachability for the nodes behind it lost for the duration.

Who can reach it

A configured EVPN signaling peer - established peering, no further authentication needed.

What to do

Upgrade to a release fixed per JSA112187; a Junos upgrade reloads the routing engine, so budget a window per device. Restricting which peers may signal EVPN/SRv6 reduces who can send the malformed update. This record does not carry fixed version numbers - read them off the advisory.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102184 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.