Description

A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:18:05.610Z",
  "pubdate": "2026-10-14T17:18:05.610Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists within the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved. The flaw is triggered when the BGP update-threading feature is enabled and a configured BGP flowspec peer sends specifically crafted flowspec route advertisements.\nThis vulnerability poses a critical risk to network infrastructure. Successful exploitation allows a remote, authenticated BGP peer to compromise the Routing Engine (RE) or induce a persistent denial of service (DoS) by crashing the routing daemon (rpd).\nThe attack is network-exploitable, requiring an adversary to have an established BGP peering relationship with the vulnerable device. By injecting malformed BGP flowspec updates, an attacker can manipulate stack memory, potentially leading to arbitrary code execution within the context of the routing daemon process.\nGiven that the routing daemon runs with elevated privileges, a successful compromise results in full control over routing protocols, traffic manipulation capabilities, and potential unauthorized access to the underlying OS. This vulnerability represents a significant threat to network stability and security, necessitating immediate administrative attention to mitigate exposure.",
  "technicalDetails": "The vulnerability resides within the packet parsing logic of the BGP daemon (rpd) responsible for processing Flowspec (BGP FS) update messages. When BGP update-threading is enabled, the daemon utilizes multi-threaded processing to handle incoming BGP updates. A flaw in the handling of Flowspec attributes allows for a stack-based buffer overflow during the re-advertisement phase or the initial processing of these updates.\nThe root cause is identified as an improper bounds check when copying Flowspec attribute data into fixed-size stack buffers. When an attacker sends a BGP update containing a malformed Flowspec NLRI (Network Layer Reachability Information) or extended community attribute, the parser fails to validate the size of the incoming data against the destination stack buffer. Because the update-threading mechanism can affect the concurrency and stack allocation context, the trigger is conditional upon this feature being active.\nThe exploitation flow begins with the attacker establishing a BGP session as a peer with the target Junos OS device. The attacker crafts a malicious BGP Update message containing a Flowspec packet. Upon receipt, the rpd process attempts to parse the Flowspec attributes. Due to the lack of sufficient length validation, the crafted payload overflows the allocated stack memory space. This overflow can be utilized to overwrite critical control flow data, such as the function return address on the stack.\nIf the attacker triggers an overwrite that redirects execution flow, they may achieve arbitrary code execution. Because the rpd process typically operates with high privileges to manage kernel routing tables and system resources, successful execution of an exploit payload grants the attacker significant control over the Routing Engine. Alternatively, if the payload is malformed in a way that causes a segmentation fault or a memory corruption exception, the rpd process will crash, leading to a denial of service. The impact of such a crash is immediate, as the BGP session will drop, and the routing daemon will require a restart, leading to a disruption of all routing services handled by the instance.\nThis vulnerability is restricted to environments where BGP update-threading is explicitly enabled, which is a common configuration for scaling performance in high-throughput network environments. Exploitation requires network reachability to the BGP speaker and successful authentication/establishment of the BGP peering session."
}