Description

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:17:51.587Z",
  "pubdate": "2026-10-14T17:17:51.587Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved.\nThe vulnerability is triggered by a remote, authenticated BGP peer when sending a specifically crafted flow-spec update that is subsequently selected for re-advertisement.\nSuccessful exploitation allows an attacker to induce a denial-of-service condition through an rpd process crash or, in the context of Junos OS, achieve remote code execution (RCE).\nThe vulnerability resides within the packet parsing or handling logic of the BGP flow-spec mechanism, presenting a critical risk to network infrastructure stability and integrity.\nExploitation requires the attacker to be a configured BGP peer, meaning the attack is directed from a trusted or pre-configured network adjacency.\nThe impact ranges from the loss of routing control plane availability to complete system compromise if code execution is achieved, potentially allowing an attacker to intercept traffic, modify routing tables, or gain unauthorized administrative access to the affected routing engine.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located within the routing protocol daemon (rpd), which serves as the central control plane component for managing BGP sessions in Junos OS and Junos OS Evolved.\nThe root cause is identified as an improper bounds check during the processing of BGP flow-spec updates. Specifically, when the rpd receives a BGP flow-spec NLRI (Network Layer Reachability Information) update, it must validate the attributes before queuing them for re-advertisement to other peers.\nDuring the re-advertisement process, the internal buffer allocated on the stack to hold the flow-spec object is insufficient for the supplied payload size when specific attributes are included. Because the length validation logic fails to account for potential packet fragmentation or overly large attribute fields during the re-encapsulation phase, an attacker can supply an update that overflows the stack frame.\nThe attack flow proceeds as follows: First, the attacker establishes a BGP peering session with the target router. Second, the attacker transmits a specially crafted BGP flow-spec update message designed to trigger the overflow upon processing. Third, the rpd selects this update for re-advertisement, triggering the vulnerable function responsible for copying the flow-spec object into the stack buffer.\nIn Junos OS Evolved, the architectural protections typically lead to an rpd process crash, resulting in a Denial of Service (DoS) where routing protocols are interrupted until the daemon restarts. In standard Junos OS, the lack of certain memory protections may allow the attacker to overwrite the saved instruction pointer on the stack.\nBy overwriting the return address, an attacker can redirect execution flow to attacker-controlled shellcode injected as part of the malicious BGP payload. This grants the attacker execution privileges within the context of the rpd process, which typically runs with elevated permissions, potentially allowing for full system compromise.\nThe vulnerability is limited to the BGP protocol stack and is not accessible from external, unauthorized network segments without an established BGP session. The exposure is therefore limited to environments where BGP peering is enabled, particularly at the edge or within a BGP-enabled core network."
}