Junos rpd: numeric truncation on a re-advertised BGP Prefix-SID lets an unauthenticated attacker crash routing

CVSS 8.7CVE-2026-33795Firmware, BMC & network fabriccurated

Impact

A BGP Prefix-SID advertisement that is subsequently re-advertised triggers a numeric truncation error and crashes rpd, interrupting routing on the device. This is the widest-reaching of the rpd issues in JSA112187: the record describes an unauthenticated network-based attacker, and the crash happens on re-advertisement, so a device several hops away from where the route entered can be the one that goes down. On a GPU fabric running segment routing that means a malformed route injected at one boundary can walk inward and knock over leaves and spines that never peered with the source. Junos and Junos Evolved releases before 20.4R1 / 20.4R1-EVO are not affected.

Who can reach it

Unauthenticated network-based attacker able to get a BGP Prefix-SID advertisement into the fabric; the crash then occurs on devices that re-advertise it, not only on the directly peered device.

What to do

Upgrade to a fixed Junos OS / Junos OS Evolved release per JSA112187, which requires a routing-engine reload on each device - and because the propagation path is what makes this dangerous, patch the border devices that accept external BGP first. Devices on releases before 20.4R1 / 20.4R1-EVO need no action. Inbound policy that filters Prefix-SID attributes at the fabric edge limits what can be injected in the meantime. No fixed version is given in this record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33795 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.