High priorityDisclosed

Advisory · CVE-2026-102016

Quantity validation flaw in Junos rpd lets an MVPN peer crash the daemon

An improper validation of specified quantity in input vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a configured BGP MVPN peer cause a denial of service via a BGP MVPN signaling update. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102016
CWE-1284
Action timing
Immediate
ELI5

Explain it like I’m five

A count field in a multicast VPN update is taken at face value, and the daemon sizes its work by a lie.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Trigger input

    An attacker sends the crafted protocol traffic described for CVE-2026-102016.

  2. 02Weakness trips

    The daemon mishandles the input through the improper validation of specified quantity in input weakness.

  3. 03Impact lands

    The routing or control-plane daemon crashes or misbehaves as described.

What happened

Juniper disclosed CVE-2026-102016 in its October 2026 security release: an improper validation of specified quantity in input (CWE-1284) in rpd. A configured BGP MVPN peer can deny service via a BGP MVPN signaling update.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for rpd crashes following MVPN signaling updates from configured peers.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Multicast VPN deployments are exactly the ones nobody wants to reboot. Patch them in a planned window before someone unplans it.