Advisory · CVE-2026-102176
Buffer overflow in Junos SDK service can compromise the routing engine when JDAF is enabled
A buffer copy without checking the size of input vulnerability in the SDK service process of Junos OS lets an unauthenticated network attacker deny service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. Juniper rates it CVSS 3.1 8.8.
- Vendor
- Juniper Networks
- Product
- Junos OS
- Identifier / CWE
- CVE-2026-102176
CWE-120 - Action timing
- Immediate
Explain it like I’m five
An optional service copies packets without checking their size, and the routing engine pays for it.
- 01Specific packets sent
An unauthenticated attacker sends packets aimed at the SDK service on a JDAF-enabled device.
- 02Unchecked copy overflows
The service copies input without checking its size and the buffer overflows.
- 03Routing Engine compromised or down
The overflow compromises the Routing Engine or denies service.
What happened
Juniper disclosed CVE-2026-102176 in its October 2026 security release: a classic buffer overflow (CWE-120) in the SDK service process of Junos OS. An unauthenticated network attacker can send specific packets to deny service or compromise the Routing Engine when the SDK service and a JDAF routing instance are enabled.
Juniper’s JSA112188 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.
What to do
- Inventory every Junos OS deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
- Review application and server logs for SDK service crashes and unusual packet types reaching devices with JDAF routing instances.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Optional services deserve the same patch urgency as core ones when they sit this close to the routing engine. Check where SDK service and JDAF are enabled.