External risk intelligence

Juniper Junos OS Routing Protocol Daemon Stack Overflow Leading to Crash or Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-101990

The vulnerability affects a BGP routing protocol daemon. BGP is a foundational internet routing protocol, but in common secure deployments, BGP sessions are restricted to authenticated, pre-configured peering relationships between known network participants and are typically not exposed to the public internet at large.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Juniper Networks' Junos OS and Junos OS Evolved that could allow a remote attacker to crash the routing protocol daemon or, in some cases, execute arbitrary code. This issue arises from a buffer overflow flaw within the routing protocol daemon when processing specific flow-spec updates. The main concern is to confirm relevance and exposure within your network infrastructure.

A routing software flaw can crash systems or allow code execution.
Affects core internet routing protocols, potentially impacting network stability.
Understand your exposure to this critical routing system vulnerability.

Attack Path

How an attacker could exploit the issue

A remote attacker with a configured BGP peer relationship can trigger this vulnerability by sending a specially crafted flow-spec update. If this update is selected for re-advertisement by the routing protocol daemon (rpd), it can lead to a stack-based buffer overflow. On Junos OS Evolved, this results in a denial-of-service by crashing the rpd. On Junos OS, this could potentially allow for remote code execution.

Requires a configured BGP peer.
Triggered by a re-advertised flow-spec update.
Risk of denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote, configured BGP peer could potentially trigger a crash in the routing protocol daemon (rpd). When supported by the advisory, this could lead to remote code execution on Juniper Networks Junos OS.

Routing protocol daemon could crash.
Specially crafted BGP update could be re-advertised.
Service disruption or unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Juniper Networks Junos OS and Junos OS Evolved affects the routing protocol daemon, potentially leading to crashes or remote code execution. Infrastructure and network security teams should lead the response, focusing initially on identifying affected systems, confirming their exposure, and understanding business criticality before planning remediation.

Infrastructure and security teams own the issue.
Verify BGP reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the role of the routing protocol daemon (rpd) in Junos OS?

The rpd is the core software component in Juniper Networks Junos OS and Junos OS Evolved that manages network routing information. It handles complex tasks like maintaining routing tables and exchanging reachability data with other routers via protocols such as BGP. Because it serves as the intelligence center for traffic flow, any instability or compromise here directly impacts the availability and security of the entire network.

What does CVE-2026-101990 mean by a stack-based buffer overflow?

This is a memory safety issue classified as CWE-121. It occurs when the software writes more data to a memory buffer than it is designed to hold, overwriting adjacent memory locations on the stack. In the context of CVE-2026-101990, this happens when the routing daemon processes a specific type of BGP update. This corruption can confuse the program's logic, leading to an unexpected crash or, under certain conditions, allowing an attacker to run unauthorized code.

How is this vulnerability triggered by a network attacker?

An attacker must have an established, configured BGP peer relationship with the target device to initiate this vulnerability. The flaw is triggered specifically when the router receives a crafted flow-spec update that the daemon then selects to re-advertise to other peers. Simply sending a generic BGP packet or having no BGP configuration does not trigger this overflow; the update must be processed through the daemon's re-advertisement logic.

Is my network exposed to this vulnerability?

According to Halo Surface Signal, this vulnerability impacts BGP, a critical protocol for internet routing. While it is classified as an external network vector, exposure depends on your configuration. In secure deployments, BGP sessions are restricted to authenticated, pre-configured peers between known participants and are rarely exposed to the open internet. You should verify if your BGP peerings are limited to trusted partners to assess your specific risk level.

What should I do if I am running Juniper Junos OS?

Start by identifying all infrastructure devices running Junos OS or Junos OS Evolved that participate in BGP peering. Once identified, prioritize these assets based on their role in your network's architecture. Security and infrastructure teams should collaborate to verify BGP reachability configurations and monitor for vendor updates provided by Juniper Networks to address this daemon-level flaw.

References

supportportal.juniper.net/JSA112187

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.