Junos rpd: BGP updates processed by BMP route monitoring overflow a stack buffer, up to root execution

Impact

When BGP Monitoring Protocol route monitoring is enabled, routes received from a BGP peer are re-encoded for export and a crafted update overflows a stack buffer in rpd, crashing the routing daemon or allowing command execution as root. Juniper assigned two ids in this advisory to this BMP route-monitoring overflow (CVE-2026-33789 and CVE-2026-33796); the component, the trigger and the fix are the same, so they are recorded together. BMP is usually turned on precisely in the fleets that have fabric telemetry pipelines, so the feature that makes a GPU fabric observable is the one that carries the exposure, and an rpd crash on a spine withdraws routes for every rail attached to it.

Who can reach it

A configured BGP peer - on a fabric that means a neighbouring leaf, spine or border router, or anything that can establish or hijack that session. The advisory describes the peer as unauthenticated for CVE-2026-33789 and as a configured external BGP neighbour for CVE-2026-33796. Requires BMP route monitoring enabled.

What to do

Upgrade Junos OS / Junos OS Evolved to a release in the Juniper JSA112187 table; do not assume a version, the advisory is the source. The upgrade reboots the device, so each affected router needs its own window and the GPU nodes behind a non-redundant path need draining. Disabling BMP route monitoring removes the trigger in the meantime, at the cost of the telemetry it feeds.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Linux kernel bnxt_re: doorbell page allocation reports success when ioremap fails, leaving unwound driver stateCVE-2026-72496 · Linux kernel bnxt_re RoCE driver (bnxt_qplib_alloc_dpi doorbell ioremap error path)Critical
• Arista EOS gNPSI: unauthenticated request yields arbitrary code execution on the switchCVE-2026-73456 · Arista EOS (gNPSI - gRPC Network Packet Sampling Interface)Critical
• Arista EOS: crafted packet brings down authenticated BFD sessions and triggers routing changesCVE-2026-73458 · Arista EOS BFD (authenticated session packet handling)Critical
• MikroTik RouterOS: SSH username argument handling lets an unauthenticated client escalate policy privilegesCVE-2026-86060 · MikroTik RouterOS (SSH login helper, policy mask handling)Critical
• Tripp Lite PDUMH15AT / SU750XL PDU: The PDU accepts unauthenticated POST requests to its /Forms/ endpoints, which canCVE-2019-16261 · Tripp Lite PDUMH15AT / SU750XL PDUCritical
• IBM OpenPower firmware OP910/OP920 - OpenBMC IPMI credential handling: The original default BMC password kept workingCVE-2019-4169 · IBM OpenPower firmware OP910/OP920 - OpenBMC IPMI credential handlingCritical