Advisory · CVE-2026-101990
Stack overflow in Junos rpd lets a BGP flowspec peer crash the daemon or run code
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP peer crash rpd, or execute code on Junos OS, with a flow-spec update that is selected for re-advertisement. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
- Vendor
- Juniper Networks
- Product
- Junos OS
- Identifier / CWE
- CVE-2026-101990
CWE-121 - Action timing
- Immediate
Explain it like I’m five
A trusted BGP neighbor can hand the routing daemon a flowspec update sized to spill its stack, turning a peering session into code execution.
- 01Flowspec update sent
A configured BGP peer sends a flow-spec update crafted to overflow rpd.
- 02Update re-advertised
The update is selected for re-advertisement, which is the path that mishandles it.
- 03rpd crashes or code runs
The stack overflow crashes rpd or, on Junos OS, executes attacker code.
What happened
Juniper disclosed CVE-2026-101990 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in rpd affecting Junos OS and Junos OS Evolved. A remote configured BGP peer can trigger it by sending a flow-spec update that gets selected for re-advertisement; on Junos OS the outcome can be remote code execution, on Evolved an rpd crash.
Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.
What to do
- Inventory every Junos OS deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
- Review application and server logs for rpd crashes or restarts following BGP flowspec updates and unexpected flowspec re-advertisements.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
BGP peers are trusted by design, which is exactly why a peer-triggerable overflow matters. Patch routing platforms and review which peers can send flowspec.