Junos OS: heap overflow in vgd lets a compromised SDN controller down the OVSDB control plane

CVSS 8.7CVE-2026-103994Firmware, BMC & network fabriccurated

Impact

A malicious or compromised SDN controller can overflow the heap in the VXLAN Gateway Daemon and cause a complete outage of the OVSDB control plane, possibly with remote code execution. VXLAN gateways are how overlay tenant networks land on physical fabric; losing the OVSDB control plane means the overlay stops being programmed, so new tenant networks and endpoint moves stall and existing state goes stale. Code execution on the gateway would put an attacker on the boundary between the overlay and the physical fabric that carries multiple tenants. The precondition is a controller the device already trusts, which makes the SDN controller itself the thing worth hardening.

Who can reach it

Adjacent network, from the position of the SDN controller: the attacker must control or have compromised the controller the device accepts OVSDB connections from.

What to do

Upgrade to a fixed Junos release per Juniper advisory JSA112188; fixed versions are not given in this record. Each upgrade reboots the device. Until then, treat the SDN controller as tier-0, keep the OVSDB channel on a dedicated management segment, and restrict which hosts can open that connection.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-103994 https://supportportal.juniper.net/JSA112188

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.