Act nowDisclosed

Advisory · CVE-2026-102178

Stack overflow in Junos rpd via flowspec re-advertisement can compromise the routing engine

A stack-based buffer overflow in the BGP routing daemon of Junos OS and Junos OS Evolved lets a configured BGP flowspec peer compromise the routing engine or deny service via flowspec route re-advertisement when BGP update-threading is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102178
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

With update-threading on, a flowspec route that gets re-advertised can overflow the routing daemon's stack, and the routing engine is the device.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Flowspec peer sends route

    A configured BGP flowspec peer sends a route that will be re-advertised.

  2. 02Update-threading path processes it

    With BGP update-threading enabled, re-advertisement handling mishandles the route.

  3. 03Routing engine hit

    The stack overflow compromises the routing engine or crashes the daemon.

What happened

Juniper disclosed CVE-2026-102178 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in the BGP routing daemon of Junos OS and Junos OS Evolved. A configured BGP flowspec peer can trigger it through flowspec route re-advertisement when BGP update-threading is enabled, leading to routing-engine compromise or a routing-daemon denial of service.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for rpd crashes on devices with BGP update-threading enabled and flowspec routes being re-advertised.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

This sits next to CVE-2026-101990 in the same flowspec code. One patch window covers both; check update-threading usage while you schedule it.