All vulnerabilities
CVE-2026-101981

Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled

Juniper Networks Junos OSNetwork & edge
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in23.4R2-S8.13Also 24.2R2-S5.5, 24.4R2-S5 and 11 moreCVE List
Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

Show all 14 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

Text from CVE List

Affected versions 15

  • Junos OSaffected: 23.4 before 23.4R2-S8.13CVE List
  • Junos OSaffected: 24.2 before 24.2R2-S5.5CVE List
  • Junos OSaffected: 24.4 before 24.4R2-S5CVE List
  • Junos OSaffected: 25.2 before 25.2R2-S2CVE List
  • Junos OSaffected: 25.4 before 25.4R1-S3CVE List
  • Junos OSaffected: 26.2 before 26.2R1-S2CVE List
  • Junos OS Evolvedaffected: 23.4 before 23.4R2-S8.11-EVOCVE List
  • Junos OS Evolvedaffected: 24.2 before 24.2R2-S5.6-EVOCVE List
  • Junos OS Evolvedaffected: 24.4 before 24.4R2-S5-EVOCVE List
  • Junos OS Evolvedaffected: 25.2 before 25.2R2-S2-EVOCVE List
  • Junos OS Evolvedaffected: 25.4 before 25.4R1-S3-EVOCVE List
  • Junos OS Evolvedaffected: 26.2 before 26.2R1-S2-EVOCVE List
  • Junos OS Evolvedaffected: 23.4X100CVE List
  • Junos OS Evolvedaffected: 25.2X100 before 25.2X100-D35-EVOCVE List
  • Junos OS Evolvedaffected: 25.4X300 before 25.4X300-D40-EVOCVE List

References 1