Junos rpd: infinite loop in EVPN multihoming preference-based DF election causes denial of service

Impact

rpd enters a loop with no exit condition during preference-based designated-forwarder election, so the routing daemon stops making progress and routing on the device is denied. The trigger is in EVPN multihoming - the configuration a fabric uses when a GPU node or storage head is dual-homed to two leaves, which is the normal build for a datacenter that does not want a single switch to isolate a rack. Unlike the parsing bugs in the same advisory, this is a state-machine hang rather than memory corruption, so it may not resolve on its own; the device needs rpd restarted. Only fabrics configured for EVPN multihoming with preference-based DF election are exposed.

Who can reach it

Remote network attacker reaching the EVPN control plane; the record does not state that authentication is required, and the affected path is EVPN multihoming DF election, so the device must be configured for it.

What to do

Upgrade to a Junos OS / Junos OS Evolved release fixed per JSA112187 - a routing-engine reload per device, so schedule it leaf by leaf while nodes still have a second uplink. Changing DF election away from the preference-based mode avoids the affected path where the design allows it. Fixed versions are in the advisory; this record lists none.

References

Related entries

• Junos OS: heap overflow in vgd lets a compromised SDN controller down the OVSDB control planeCVE-2026-103994 · Juniper Junos OS VXLAN Gateway Daemon (vgd, OVSDB control plane)High
• AMI AptioV UEFI firmware: incomplete input validation lets a privileged local user execute code in firmware contextCVE-2026-33197 · AMI AptioV UEFI firmware (BIOS input validation)High
• Junos rpd: numeric truncation on a re-advertised BGP Prefix-SID lets an unauthenticated attacker crash routingCVE-2026-33795 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, BGP Prefix-SID re-advertisement)High
• Junos OS on SRX: stack overflow in srxpfe gives root code execution from the HA fabric linkCVE-2026-33798 · Juniper Junos OS / Junos OS Evolved on SRX Series (srxpfe, high-availability fabric traffic)High
• Linux kernel mlx5_core eswitch / vport (SR-IOV): Mlx5_core sizes a firmware command buffer from the physical function'sCVE-2026-53230 · Linux kernel mlx5_core eswitch / vport (SR-IOV)High
• Arista EOS gNMI: crafted request from an authenticated client executes code as rootCVE-2026-73464 · Arista EOS (gNMI - gRPC Network Management Interface)High