High priorityDisclosed

Advisory · CVE-2026-102025

Mismatched memory handling in Junos rpd lets a BGP update crash it under SRv6 processing

A mismatched memory management routines vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an authenticated network attacker cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102025
CWE-762
Action timing
Immediate
ELI5

Explain it like I’m five

Memory freed the wrong way is memory corrupted slowly, and SRv6 route updates are the trigger.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Trigger input

    An attacker sends the crafted protocol traffic described for CVE-2026-102025.

  2. 02Weakness trips

    The daemon mishandles the input through the mismatched memory management routines weakness.

  3. 03Impact lands

    The routing or control-plane daemon crashes or misbehaves as described.

What happened

Juniper disclosed CVE-2026-102025 in its October 2026 security release: a mismatched memory management routines vulnerability (CWE-762) in rpd. A BGP route update can deny service when extended next-hop tunneling and SRv6 service processing are used.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for rpd crashes on SRv6 deployments following BGP route updates.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

SRv6 rollouts are new enough that patch discipline is still forming. This is a good reason to form it now.