High priorityDisclosed

Advisory · CVE-2026-101981

Stack overflow in Junos rpd lets an adjacent LDP peer run code via label mappings

A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated adjacent LDP peer crash rpd or execute arbitrary code with a malformed LDP Label Mapping message. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-101981
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

An LDP neighbor does not need credentials, just a label mapping message built to spill the stack.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01LDP peer connects

    An unauthenticated adjacent peer establishes or uses an LDP session.

  2. 02Malformed label mapping sent

    The peer sends a Label Mapping message crafted to overflow rpd.

  3. 03Code runs or rpd crashes

    The stack overflow executes arbitrary code or crashes the daemon.

What happened

Juniper disclosed CVE-2026-101981 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in rpd. An unauthenticated adjacent LDP peer can send a malformed LDP Label Mapping message to crash rpd or execute arbitrary code. The vendor record lists the affected releases starting with the 23.4 line.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for rpd crashes following LDP session activity and label mapping messages with unusual sizes.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

MPLS cores trust LDP neighbors implicitly. Patch core routers and confirm LDP sessions only exist where they should.