All vulnerabilities
CVE-2026-102087

Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes

Juniper Networks Junos OSNetwork & edge
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in23.2R2-S6Also 23.4R2-S7, 24.2R2-S4 and 7 moreCVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

Show all 10 fixed versions
  • 23.4R2-S8.11-EVOJunos OS EvolvedCVE List
  • 24.2R2-S4-EVOJunos OS EvolvedCVE List
  • 24.4R2-S5-EVOJunos OS EvolvedCVE List
  • 25.2R1-S2-EVO, 25.2R2-EVOJunos OS EvolvedCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.

This issue affects: Junos OS:

  • All versions before 23.2R2-S6;
  • 23.4 versions before 23.4R2-S7;
  • 24.2 versions before 24.2R2-S4;
  • 24.4 versions before 24.4R2-S4;
  • 25.2 versions before 25.2R1-S2, 25.2R2;

Junos OS Evolved:

  • All versions before 23.2R2-S6-EVO;
  • 23.4 versions before 23.4R2-S8.11-EVO;
  • 24.2 versions before 24.2R2-S4-EVO;
  • 24.4 versions before 24.4R2-S5-EVO;
  • 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;

Text from CVE List

Affected versions 10

  • Junos OSaffected: all versions before 23.2R2-S6CVE List
  • Junos OSaffected: 23.4 before 23.4R2-S7CVE List
  • Junos OSaffected: 24.2 before 24.2R2-S4CVE List
  • Junos OSaffected: 24.4 before 24.4R2-S4CVE List
  • Junos OSaffected: 25.2 before 25.2R1-S2, 25.2R2CVE List
  • Junos OS Evolvedaffected: all versions before 23.2R2-S6-EVOCVE List
  • Junos OS Evolvedaffected: 23.4 before 23.4R2-S8.11-EVOCVE List
  • Junos OS Evolvedaffected: 24.2 before 24.2R2-S4-EVOCVE List
  • Junos OS Evolvedaffected: 24.4 before 24.4R2-S5-EVOCVE List
  • Junos OS Evolvedaffected: 25.2 before 25.2R1-S2-EVO, 25.2R2-EVOCVE List

References 1