Advisory · CVE-2026-102020
Reachable assertion in Junos rpd lets a BGP-LS update crash the daemon
A reachable assertion vulnerability in the rpd process of Junos OS and Junos OS Evolved lets an authenticated network-based attacker cause a denial of service via BGP-LS routing updates. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
- Vendor
- Juniper Networks
- Product
- Junos OS
- Identifier / CWE
- CVE-2026-102020
CWE-617 - Action timing
- Immediate
Explain it like I’m five
A link-state update for traffic engineering trips an assertion, and the routing daemon stops instead of routing.
- 01Trigger input
An attacker sends the crafted protocol traffic described for CVE-2026-102020.
- 02Weakness trips
The daemon mishandles the input through the reachable assertion weakness.
- 03Impact lands
The routing or control-plane daemon crashes or misbehaves as described.
What happened
Juniper disclosed CVE-2026-102020 in its October 2026 security release: a reachable assertion vulnerability (CWE-617) in rpd. BGP-LS routing updates from an authenticated network attacker can deny service.
Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.
What to do
- Inventory every Junos OS deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
- Review application and server logs for rpd assertion failures and crashes following BGP-LS updates.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
BGP-LS feeds controllers that steer traffic. A crash here can blind the controller as well as the router.