External risk intelligence

Juniper Junos OS BGP Flowspec Re-advertisement Stack Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-102178

The vulnerability affects BGP routing daemons. While BGP is a network protocol, peering sessions are typically established between specific, trusted infrastructure, such as internet service providers or internal network gateways. Public internet exposure is uncommon as these sessions are restricted to authorized BGP peers and are generally protected by access control lists or direct physical/virtual connections.

Buffer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Juniper Networks' Junos OS and Junos OS Evolved, specifically impacting the Border Gateway Protocol (BGP) routing daemon. A malicious, configured BGP peer could exploit this flaw to gain control of the routing engine or cause a denial of service by re-advertising flowspec routes under certain conditions. This could potentially disrupt critical network routing functions.

A routing flaw could allow a connected peer to disrupt services.
This affects core network routing infrastructure.
Confirm relevance and exposure to your BGP environment.

Attack Path

How an attacker could exploit the issue

A remote attacker with an existing BGP peering session could exploit this vulnerability by sending specially crafted flowspec routes. If BGP update-threading is enabled on the affected Juniper devices, this could lead to a compromise of the routing engine or a denial of service for the routing daemon.

Requires an established BGP peering.
Triggered by re-advertising flowspec routes.
Risk includes routing engine compromise or DoS.

Live Threat

Current exploitation, exposure, and threat context

A configured BGP flowspec peer could trigger a stack-based buffer overflow in the routing daemon, potentially leading to a compromise of the routing engine or a denial of service. This could occur when BGP update-threading is enabled and the peer re-advertises flowspec routes.

Routing-engine compromise or DoS.
Triggered by BGP flowspec re-advertisement.
Disrupts network routing services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Juniper Networks Junos OS and Junos OS Evolved, specifically their BGP routing daemons. The primary responsibility for addressing this likely falls to the network infrastructure or platform teams responsible for managing these routing devices and their BGP configurations. The first practical step is to identify all systems running the affected software, confirm their exposure to BGP flowspec peers, and determine their business criticality to prioritize remediation efforts.

Network infrastructure teams own remediation.
Verify BGP flowspec peer reachability.
Plan maintenance for risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BGP routing daemon in Junos OS?

Junos OS and Junos OS Evolved are operating systems that power Juniper Networks routing and switching hardware. The BGP routing daemon is a background software process responsible for managing the Border Gateway Protocol. This protocol acts as the 'postal service' of the internet and large enterprise networks, automatically determining the most efficient paths for data traffic to travel between network segments.

What does CVE-2026-102178 mean?

This CVE identifies a stack-based buffer overflow, categorized as CWE-121. In simple terms, the software fails to properly check the size of incoming data before storing it in a specific memory area called the stack. Because the BGP daemon expects a certain amount of information but receives more than it can handle, it overwrites adjacent memory, which can lead to a crash or, more severely, give an attacker unauthorized control over the routing system.

What triggers this buffer overflow?

The vulnerability is triggered when a BGP peer sends specifically crafted flowspec route advertisements to the device. Crucially, the bug only activates when BGP update-threading is enabled on the Juniper system. If update-threading is disabled, or if the incoming traffic does not involve the re-advertisement of these specific flowspec routes, the trigger condition is not met.

Is my network at risk from this vulnerability?

Halo Surface Signal notes that while this is a network-level issue, it is unlikely for most systems because BGP peering is typically restricted to trusted, pre-configured infrastructure. You are primarily at risk if your device accepts BGP flowspec sessions from external or untrusted peers. If your BGP sessions are limited to private, known partners or protected by strict access controls, your practical exposure is significantly reduced.

How should I respond to this Juniper advisory?

Begin by auditing your infrastructure to identify all devices running Junos OS or Junos OS Evolved that currently participate in BGP flowspec sessions. Once identified, check if BGP update-threading is enabled on these systems. Prioritize high-criticality routing engines for updates or configuration changes, and consult official Juniper support documentation to determine the appropriate software path or configuration workaround for your environment.

References

supportportal.juniper.net/JSA112187

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.