]"}],"datePublic":"2026-10-14T16:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).
When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.
This issue affects:
Junos OS:
- All versions before 23.2R2-S6;
- 23.4 versions before 23.4R2-S7;
- 24.2 versions before 24.2R2-S4;
- 24.4 versions before 24.4R2-S4;
- 25.2 versions before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
- All versions before 23.2R2-S6-EVO;
- 23.4 versions before 23.4R2-S8.11-EVO;
- 24.2 versions before 24.2R2-S4-EVO;
- 24.4 versions before 24.4R2-S5-EVO;
- 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
"}],"value":"An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\nWhen in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.\n\nThis issue affects:\nJunos OS:\n\n\n * All versions before 23.2R2-S6;\n * 23.4 versions before 23.4R2-S7;\n * 24.2 versions before 24.2R2-S4;\n * 24.4 versions before 24.4R2-S4;\n * 25.2 versions before 25.2R1-S2, 25.2R2;\n\n\n\nJunos OS Evolved:\n * All versions before 23.2R2-S6-EVO;\n * 23.4 versions before 23.4R2-S8.11-EVO;\n * 24.2 versions before 24.2R2-S4-EVO;\n * 24.4 versions before 24.4R2-S5-EVO;\n * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;"}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/RE:M","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-184","description":"CWE-184 Incomplete Blacklist","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","shortName":"juniper","dateUpdated":"2026-10-14T16:23:55.281Z"},"references":[{"tags":["vendor-advisory"],"url":"https://supportportal.juniper.net/JSA112168"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue:\n
\nJunos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R1-S2, 25.2R2, 25.4R1, and all subsequent releases;
Junos OS Evolved: 23.2R2-S6-EVO, 23.4R2-S8.11-EVO, 24.2R2-S4-EVO, 24.4R2-S5-EVO, 25.2R1-S2-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases.
\n\n\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.\n\n\n\n
"}],"value":"The following software releases have been updated to resolve this specific issue:\n\n\nJunos OS: 23.2R2-S6, 23.4R2-S7, 24.2R2-S4, 24.4R2-S4, 25.2R1-S2, 25.2R2, 25.4R1, and all subsequent releases;\nJunos OS Evolved: 23.2R2-S6-EVO, 23.4R2-S8.11-EVO, 24.2R2-S4-EVO, 24.4R2-S5-EVO, 25.2R1-S2-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases.\n\n\n\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."}],"source":{"advisory":"JSA112168","defect":["1908614"],"discovery":"USER"},"title":"Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no known workarounds for this issue."}],"value":"There are no known workarounds for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102087","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T20:16:18.843641Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T20:26:06.313Z"}}]}}