CVE-2026-101943: CWE-20 Improper Input Validation in Juniper Networks Junos OS

This vulnerability arises from improper input validation in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker can exploit this flaw by crafting a malicious BGP EVPN update message, which when processed by the vulnerable rpd, causes a denial of service condition. The vulnerability affects a range of Junos OS versions prior to various patch releases, including both standard and evolved editions. The CVSS 3.1 base score is 7.5, with attack vector network, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No known exploits are reported in the wild at this time.

Successful exploitation results in denial of service of the routing protocol daemon, potentially disrupting network routing operations. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability can be triggered remotely without authentication, increasing the risk of network disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected versions are clearly identified, so users should monitor Juniper Networks advisories for official patches or updates addressing this issue. Until patches are applied, network administrators should consider mitigating exposure by controlling access to BGP EVPN update message sources if possible.